CVE-2026-87504: Google Chrome Use After Free Vulnerability

CVE-2026-87504 Overview

CVE-2026-87504 is a use-after-free vulnerability in the Core component of Google Chrome prior to version 153.0.8010.36. A remote attacker can leverage social engineering to install a crafted Chrome extension that triggers memory corruption. Successful exploitation allows arbitrary code execution outside the Chrome sandbox, giving the attacker the same privileges as the browser user. The flaw is tracked under CWE-416: Use After Free and is scoped as Changed, meaning impact extends beyond the vulnerable component. Google has published a fix in the Stable channel update for desktop.

Critical Impact
Arbitrary code execution outside the Chrome sandbox via a crafted extension, resulting in full compromise of the user's browser session and host-level code execution rights.

Affected Products

Google Chrome for Desktop versions prior to 153.0.8010.36
Chromium-based browsers integrating the vulnerable Core component
All operating systems supported by the Chrome Stable channel (Windows, macOS, Linux)

Discovery Timeline

2026-09-09 - CVE-2026-87504 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87504

Vulnerability Analysis

The flaw resides in Chrome's Core component and stems from a use-after-free condition [CWE-416]. A crafted extension triggers a code path in which an object is freed while another reference still points to the freed memory. When the browser later dereferences that stale pointer, an attacker can control the memory contents and steer execution flow. Because the corruption occurs in a privileged browser process rather than a sandboxed renderer, exploitation results in code execution outside the sandbox. The vector requires user interaction, specifically installation or activation of the malicious extension, so social engineering is the primary delivery method.

Root Cause

The root cause is improper lifetime management of an object in the Chrome Core module. A reference to the object persists after the allocator reclaims its backing memory. Attacker-controlled allocations can reoccupy that memory region, letting the crafted extension shape the freed structure before the dangling reference is used.

Attack Vector

Exploitation proceeds over the network with low complexity and no prior privileges, but requires the victim to install a crafted Chrome extension. Once the extension executes within Chrome, it drives the vulnerable Core code path, triggers the use-after-free, and pivots to arbitrary code execution in a process running outside the renderer sandbox. Technical exploitation details are tracked in the Chromium Issue Tracker Entry and summarized in the Google Chrome Stable Update advisory.

Detection Methods for CVE-2026-87504

Indicators of Compromise

Installation of newly published or low-reputation Chrome extensions immediately prior to browser process crashes.
Chrome browser or utility process crashes referencing heap corruption, access violations, or EXCEPTION_ACCESS_VIOLATION in the Core component.
Unexpected child processes spawned by chrome.exe such as command shells, script interpreters, or LOLBins.
Outbound network connections from Chrome host processes to unfamiliar command-and-control infrastructure.

Detection Strategies

Inventory installed Chrome extensions across managed endpoints and compare against an allowlist to surface sideloaded or unmanaged additions.
Alert on Chrome versions below 153.0.8010.36 reported by endpoint telemetry or software inventory tooling.
Correlate Chrome process crashes with extension installation events within a short time window to detect exploitation attempts.

Monitoring Recommendations

Forward Chrome policy, extension install, and crash telemetry to a central logging platform for retention and correlation.
Monitor process lineage from chrome.exe for anomalous child processes and script execution.
Track egress traffic from browser processes to newly registered domains and non-standard ports.

How to Mitigate CVE-2026-87504

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints.
Restart the browser after the update to ensure the patched binaries are loaded into memory.
Audit installed extensions and remove any that are unmanaged, unverified, or recently sideloaded.
Enforce enterprise policy that restricts extension installations to an approved allowlist.

Patch Information

Google addressed the vulnerability in the Chrome Stable channel update documented in the Google Chrome Stable Update. Administrators should confirm the deployed build is 153.0.8010.36 or newer. Additional developer context is available in the Chromium Issue Tracker Entry.

Workarounds

Configure the ExtensionInstallAllowlist and ExtensionInstallBlocklist enterprise policies to prevent installation of untrusted extensions.
Disable developer mode for extensions to block sideloading of unpacked packages.
Educate users on social engineering tactics that push malicious extension installs from unfamiliar websites or messages.

bash

# Example Chrome enterprise policy to block all extensions except an approved allowlist (Linux path)
# /etc/opt/chrome/policies/managed/extension_policy.json
{
  "ExtensionInstallBlocklist": ["*"],
  "ExtensionInstallAllowlist": [
    "<approved-extension-id-1>",
    "<approved-extension-id-2>"
  ],
  "DeveloperToolsAvailability": 2
}