CVE-2026-87514: Google Chrome Use After Free Vulnerability

CVE-2026-87514 Overview

CVE-2026-87514 is a use-after-free vulnerability in the Views component of Google Chrome versions prior to 153.0.8010.36. A local attacker who runs a crafted program on the target system can trigger the flaw to execute arbitrary code outside the Chrome sandbox. Chromium security engineers rated the issue High severity. The vulnerability maps to CWE-416: Use After Free and carries a scope change, meaning successful exploitation impacts resources beyond the vulnerable component. Google addressed the defect in the Stable channel release announced through the Google Chrome Update Announcement.

Critical Impact
Local attackers can escape the Chrome sandbox and execute arbitrary code with the privileges of the browser process, undermining a core browser security boundary.

Affected Products

Google Chrome for Desktop versions prior to 153.0.8010.36
Chromium-based browsers sharing the vulnerable Views component code
Deployments where Chrome auto-update is disabled or delayed by policy

Discovery Timeline

2026-09-09 - CVE-2026-87514 published to the National Vulnerability Database
2026-09-10 - Entry last modified in the NVD

Technical Details for CVE-2026-87514

Vulnerability Analysis

The defect resides in Chrome's Views framework, the internal UI toolkit that Chromium uses to render browser chrome elements such as menus, tabs, and dialogs. A use-after-free condition occurs when code retains a reference to a Views object after that object has been freed. Subsequent access to the dangling pointer allows an attacker to manipulate freed memory and hijack control flow.

Because Views executes in the browser process rather than the sandboxed renderer, code execution through this bug reaches outside the sandbox. That places the attacker at the same privilege level as Chrome itself, enabling access to the file system, credential stores, and network resources available to the user account running the browser.

Exploitation requires local access. The attacker must run a program on the same host as Chrome, which limits remote reach but aligns the flaw with post-compromise attack chains where an initial foothold pivots to a browser process to steal session tokens or persist.

Root Cause

The root cause is improper lifetime management of a Views object referenced across asynchronous UI operations. When the underlying object is destroyed while a pointer remains in scope, subsequent dereferences read or write freed heap memory. This is a textbook CWE-416 pattern. Additional context is available in the Chromium Issue Tracker Entry.

Attack Vector

The attack vector is local. A malicious program running on the same host interacts with Chrome to drive the vulnerable Views code path, groom the heap, and reuse the freed allocation. Successful exploitation grants code execution in the browser process, bypassing the renderer sandbox that normally contains web-origin threats. No public proof-of-concept or in-the-wild exploitation has been reported.

No verified exploit code is publicly available. See the Chromium Issue Tracker Entry for developer-level details as they become accessible.

Detection Methods for CVE-2026-87514

Indicators of Compromise

Unexpected child processes spawned by chrome.exe or the Chrome browser process on macOS and Linux
Chrome browser process performing file writes or network connections inconsistent with normal browsing activity
Local processes injecting into or opening handles to the Chrome browser process
Crash reports referencing the Views subsystem prior to the patched version

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build below 153.0.8010.36
Monitor for local programs invoking Chrome with unusual command-line arguments or IPC patterns
Alert on browser process memory tampering, remote thread creation, or unexpected module loads
Correlate local privilege escalation events with subsequent browser process anomalies

Monitoring Recommendations

Enable endpoint detection telemetry for browser process integrity, including image loads and handle access
Track Chrome auto-update status through management tooling to confirm the patched build is deployed
Ingest browser crash dumps into centralized analysis to catch attempted exploitation that fails
Review authentication and cookie access logs for signs of post-exploitation token theft

How to Mitigate CVE-2026-87514

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all Windows, macOS, and Linux endpoints
Restart Chrome after the update to ensure the patched binary is loaded into memory
Verify Chrome auto-update is enabled and functioning through group policy or MDM configuration
Audit and remove untrusted local software that could serve as the exploitation vehicle

Patch Information

Google released the fix in the Stable channel version 153.0.8010.36. Full release notes are available in the Google Chrome Update Announcement. Enterprise administrators should push the update through their existing software distribution channels and validate the deployed version across the fleet.

Workarounds

No vendor-supplied workaround exists; patching is the only supported remediation
Restrict local administrative rights and application installation to reduce the pool of programs that could exploit the flaw
Enforce application allowlisting to block execution of untrusted binaries capable of triggering the vulnerability
Isolate high-value user accounts on hardened workstations until the patch is confirmed deployed

bash

# Verify installed Chrome version on Windows
reg query "HKLM\SOFTWARE\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Verify installed Chrome version on macOS
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString

# Verify installed Chrome version on Linux
google-chrome --version