CVE-2026-87524: Google Chrome Use-After-Free Vulnerability

CVE-2026-87524 Overview

CVE-2026-87524 is a use-after-free vulnerability [CWE-416] in the Core component of Google Chrome on Windows. The flaw affects versions prior to 153.0.8010.36. A remote attacker who has already compromised the renderer process can potentially execute arbitrary code outside the Chrome sandbox by serving a crafted HTML page. Google classifies the Chromium security severity as High. Successful exploitation breaks the browser's primary security boundary, giving attackers code execution in a higher-privileged process context on the host system.

Critical Impact
Attackers can escape the Chrome sandbox and execute arbitrary code on Windows hosts, bypassing a core browser security boundary.

Affected Products

Google Chrome on Windows prior to 153.0.8010.36
Microsoft Windows (as the host operating system)
Chromium-based Core component

Discovery Timeline

2026-09-09 - CVE-2026-87524 published to NVD
2026-09-10 - Last updated in NVD database
Google released the fix in the Chrome Stable channel update referenced in the Google Chrome Stable Update advisory

Technical Details for CVE-2026-87524

Vulnerability Analysis

The vulnerability is a use-after-free condition in Chrome's Core component. Use-after-free flaws occur when code references memory after it has been freed, allowing an attacker to reuse the freed allocation with attacker-controlled data. In the browser context, this enables corruption of internal object state and can lead to control-flow hijacking.

Exploitation requires the attacker to first compromise the renderer process, then use the crafted HTML page to trigger the freed-object reuse in a privileged Chrome process. Because the flaw resides in Core, successful exploitation extends attacker capability beyond the sandboxed renderer and into the browser process, resulting in arbitrary code execution on the host.

Root Cause

The root cause is improper lifetime management of an object in the Chrome Core code path. A reference to the object persists after the allocation is released, allowing subsequent access to a dangling pointer. Further technical details are tracked in Chromium Issue Tracker #522546457.

Attack Vector

The attack chain is network-based but requires user interaction and prior renderer compromise. An attacker delivers a crafted HTML page, typically through a malicious or compromised website. After compromising the renderer, the attacker triggers the use-after-free in the Core component to escape the sandbox. The scope is changed, indicating the impact crosses the sandbox trust boundary into a more privileged process.

No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical details are described in Chromium Issue Tracker #522546457; no verified exploit code is published at this time.

Detection Methods for CVE-2026-87524

Indicators of Compromise

Chrome browser processes spawning unexpected child processes such as cmd.exe, powershell.exe, or rundll32.exe
Chrome renderer or browser process crashes with access-violation exceptions preceding suspicious process activity
Outbound network connections to unfamiliar domains immediately followed by anomalous file writes in user profile directories
Chrome installations reporting version strings below 153.0.8010.36 on Windows endpoints

Detection Strategies

Inventory Chrome versions across managed Windows endpoints and flag any build earlier than 153.0.8010.36
Monitor process trees for chrome.exe parenting non-standard executables, which can indicate a successful sandbox escape
Correlate browser crash telemetry with subsequent process creation events on the same host within a short time window

Monitoring Recommendations

Ingest Windows Sysmon Event ID 1 (process creation) and Event ID 11 (file create) for endpoints running Chrome
Alert on Chrome loading unsigned modules or writing executable files to %APPDATA% or %LOCALAPPDATA%
Track browser telemetry for repeated renderer crashes on specific URLs, which may indicate exploitation attempts

How to Mitigate CVE-2026-87524

Immediate Actions Required

Update Google Chrome on all Windows systems to version 153.0.8010.36 or later
Verify the Chrome update channel is set to Stable and that automatic updates are functioning
Restart Chrome after patching to ensure the vulnerable code paths are unloaded from memory
Prioritize patching for users who browse untrusted content or handle sensitive data

Patch Information

Google released the fix in the Chrome Stable channel. Administrators should deploy the update referenced in the Google Chrome Stable Update advisory. The fixed version for Windows is 153.0.8010.36. Enterprise environments can push the update through Chrome Enterprise policies, Microsoft Intune, SCCM, or equivalent management tooling.

Workarounds

Restrict browsing to trusted sites until patching is complete, using web filtering or proxy allowlists
Enforce Site Isolation and ensure sandbox-hardening policies remain enabled in Chrome Enterprise
Deploy application-control policies to block Chrome from spawning script interpreters or shell binaries as child processes

bash

# Verify Chrome version on a Windows endpoint (PowerShell)
(Get-Item "$env:ProgramFiles\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# Force Chrome update via Google Update on managed endpoints
"$env:ProgramFiles(x86)\Google\Update\GoogleUpdate.exe" /ua /installsource scheduler