CVE-2026-87526: Google Chrome Use After Free Vulnerability

CVE-2026-87526 Overview

CVE-2026-87526 is a use-after-free vulnerability [CWE-416] in the Passwords component of Google Chrome. The flaw affects versions prior to 153.0.8010.36. A remote attacker who convinces a user to perform specific UI interactions can trigger the freed memory condition and potentially execute arbitrary code outside the Chrome sandbox. Google classifies the Chromium security severity as Medium, while the NVD CVSS 3.1 score is 9.6.

Critical Impact
Successful exploitation permits sandbox escape and arbitrary code execution in the context of the browser user, with scope change beyond the renderer boundary.

Affected Products

Google Chrome for Desktop prior to 153.0.8010.36
Chromium-based browsers incorporating the vulnerable Passwords component
Enterprise Chrome deployments on Windows, macOS, and Linux prior to the patched Stable channel

Discovery Timeline

2026-09-09 - CVE-2026-87526 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87526

Vulnerability Analysis

The vulnerability resides in the Passwords subsystem of Chrome, which handles saved credentials and the associated UI surfaces. A use-after-free condition occurs when the browser continues to access a heap object after it has been released. An attacker who lures a user to a malicious page and induces specific UI interactions with password prompts or autofill dialogs can drive the object lifecycle into an inconsistent state. Once the dangling pointer is dereferenced, memory corruption enables control of program flow. Because the affected code paths run in a privileged browser process rather than the sandboxed renderer, successful exploitation can escape the sandbox. The NVD vector reports a scope change and high confidentiality, integrity, and availability impact, reflecting cross-privilege-boundary consequences.

Root Cause

The root cause is improper object lifetime management inside the Passwords component. Chrome frees a heap-allocated structure while an outstanding reference remains reachable from UI event handlers. A subsequent interaction dereferences the stale pointer, allowing an attacker who has groomed the heap to redirect execution.

Attack Vector

Exploitation requires user interaction and is delivered over the network. The attacker hosts a crafted page and uses social engineering to prompt the victim to click, hover, or otherwise interact with password-related UI elements. No authentication is required, and the attack complexity is low.

No public proof-of-concept exploit code is available. Refer to the Chromium Issue Tracker #544484669 once access restrictions are lifted for technical specifics.

Detection Methods for CVE-2026-87526

Indicators of Compromise

Chrome browser processes spawning unexpected child processes such as cmd.exe, powershell.exe, or shell interpreters immediately after a browsing session
Renderer or browser process crashes referencing the Passwords component in Chrome crash telemetry
Outbound connections from chrome.exe to newly registered or low-reputation domains hosting credential-themed lures

Detection Strategies

Inventory installed Chrome versions across the estate and flag any host running a build earlier than 153.0.8010.36
Hunt for anomalous process trees where chrome.exe is the parent of scripting hosts, LOLBins, or unsigned binaries
Correlate browser crash events with subsequent persistence or lateral movement attempts on the same host

Monitoring Recommendations

Enable browser telemetry forwarding to a central analytics tier and alert on repeated Passwords-component crashes
Monitor endpoint EDR telemetry for unsigned modules loaded into Chrome processes
Track Chrome auto-update status through management tooling to confirm timely rollout of the fixed Stable channel

How to Mitigate CVE-2026-87526

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all Windows, macOS, and Linux endpoints
Restart browser sessions after the update installs to ensure the patched binaries are loaded into memory
Audit Chromium-based browsers such as Edge, Brave, and Opera and apply their corresponding upstream fixes

Patch Information

Google addressed the flaw in the Stable channel release documented in the Google Chrome Stable Update. Administrators should verify deployment through enterprise policy or MDM, and confirm that end users have relaunched the browser to complete the update.

Workarounds

Disable the built-in Chrome password manager and autofill features via enterprise policy until patching is confirmed
Restrict browsing to trusted domains through URL filtering to reduce social engineering exposure
Provide user awareness guidance warning against interacting with unexpected password prompts on untrusted sites

bash

# Verify Chrome version on Linux endpoints
google-chrome --version

# Enterprise policy snippet to disable password manager (Windows registry)
# HKLM\Software\Policies\Google\Chrome\PasswordManagerEnabled = 0