CVE-2026-87497 Overview
CVE-2026-87497 is an uninitialized resource vulnerability in the Codecs component of Google Chrome versions prior to 153.0.8010.36. A remote attacker can read memory contents inside the browser sandbox by serving a crafted HTML page to a victim. The issue is tracked in Chromium as issue 504670493 and rated Medium severity by the Chromium security team. The flaw maps to CWE-908: Use of Uninitialized Resource.
Critical Impact
A remote attacker can disclose uninitialized memory inside the Chrome sandbox by luring a user to a malicious page, exposing data that may aid in chaining further exploits.
Affected Products
- Google Chrome for Desktop prior to 153.0.8010.36
- Chromium-based browsers that embed the vulnerable Codecs code
- Downstream builds sharing the affected Codecs component
Discovery Timeline
- 2026-09-09 - CVE-2026-87497 published to the National Vulnerability Database
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-87497
Vulnerability Analysis
The vulnerability resides in the Chrome Codecs subsystem, which decodes audio and video streams delivered through web content. Chrome fails to fully initialize a resource before it is read, causing residual memory to be exposed to attacker-controlled processing paths. Because Codecs handle attacker-supplied media, a crafted HTML page can trigger the decode path and observe the leaked bytes. The disclosure occurs inside the renderer sandbox, so exploitation does not by itself grant code execution.
Root Cause
The root cause is classified under CWE-908: Use of Uninitialized Resource. A buffer, structure, or object in the Codecs code path is consumed before all fields receive defined values. The uninitialized bytes originate from prior allocations in the same address space and can carry pointers, tokens, or media data. Google has not released the specific source location while restricting access to the Chromium bug tracker entry.
Attack Vector
Exploitation requires network access and user interaction, matching the CVSS vector for the issue. An attacker hosts a crafted HTML page referencing a specially built media asset that exercises the vulnerable codec path. When the victim visits the page, the renderer processes the media and returns uninitialized memory to attacker-observable channels such as decoded pixel data or JavaScript-accessible buffers. The leaked memory can then be exfiltrated to inform follow-on attacks against the browser or user session.
No public proof-of-concept exploit is available. Technical specifics are limited to the Chromium Issue #504670493 tracker entry and the Google Chrome Stable Channel Update.
Detection Methods for CVE-2026-87497
Indicators of Compromise
- Chrome browser processes running versions earlier than 153.0.8010.36 in enterprise inventory scans
- Renderer processes loading media from untrusted origins immediately followed by anomalous outbound requests carrying binary payloads
- Web traffic to unknown domains serving crafted <video>, <audio>, or Media Source Extensions content to targeted users
Detection Strategies
- Inventory installed Chrome versions across managed endpoints and flag any build below 153.0.8010.36
- Correlate browsing telemetry with threat intelligence feeds identifying malicious media-hosting infrastructure
- Monitor renderer child processes for unusual memory growth or crash signatures tied to codec modules
Monitoring Recommendations
- Enable centralized browser version reporting through Chrome Enterprise Core or equivalent management tooling
- Alert on outbound transfers from renderer processes that follow first-visit media playback from unfamiliar domains
- Track Chrome crash telemetry for repeated faults in Codecs code paths that may indicate exploitation attempts
How to Mitigate CVE-2026-87497
Immediate Actions Required
- Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints
- Restart Chrome after applying the update to ensure the patched binary is loaded
- Audit Chromium-based browsers and embedded frameworks for updates that incorporate the upstream fix
Patch Information
Google addressed the issue in the Chrome Stable Channel update announced in the Google Chrome Stable Channel Update. The fixed version is 153.0.8010.36. Chromium-based browser vendors typically publish corresponding builds shortly after the upstream release; verify each vendor's advisory before considering the fleet remediated.
Workarounds
- Restrict browsing to trusted sites through enterprise web filtering until the patch is deployed
- Disable autoplay and preload of media content from untrusted origins via Chrome policy where feasible
- Isolate high-risk browsing activity in dedicated virtual machines or remote browser isolation platforms
# Configuration example: enforce minimum Chrome version via Chrome Enterprise policy (Windows registry)
reg add "HKLM\Software\Policies\Google\Chrome" /v TargetVersionPrefix /t REG_SZ /d "153.0.8010.36" /f
reg add "HKLM\Software\Policies\Google\Chrome" /v RelaunchNotification /t REG_DWORD /d 2 /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
