CVE-2026-87528: Google Chrome Type Confusion RCE Vulnerability

CVE-2026-87528 Overview

CVE-2026-87528 is a type confusion vulnerability in the Rust code path of Google Chrome on Windows. The flaw affects all Chrome versions on Windows prior to 153.0.8010.36. A remote attacker can exploit the issue by serving a crafted HTML page to a targeted user. Successful exploitation allows arbitrary code execution outside the Chrome sandbox, giving the attacker code execution in the context of the user. The vulnerability is tracked under CWE-843: Access of Resource Using Incompatible Type. Google has classified the Chromium security severity as Medium, while NVD scoring places it in the critical range due to sandbox escape potential.

Critical Impact
Remote attackers can achieve arbitrary code execution outside the Chrome sandbox on Windows endpoints by luring a user to a malicious web page.

Affected Products

Google Chrome on Windows prior to 153.0.8010.36
Microsoft Windows hosts running vulnerable Chrome builds
Chromium-based downstream browsers that inherit the affected Rust component

Discovery Timeline

2026-09-09 - CVE-2026-87528 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87528

Vulnerability Analysis

The vulnerability is a type confusion condition inside Rust code shipped with Chrome on Windows. Type confusion occurs when code accesses a resource assuming one type while the underlying memory holds a different type. In Rust, such conditions typically arise from unsafe blocks, foreign function interface (FFI) boundaries with C++ Chromium code, or incorrect trait object handling. An attacker who controls the object layout can force the browser to interpret attacker-supplied data as a trusted type. The resulting misinterpretation yields memory corruption that can be shaped into arbitrary code execution. Notably, exploitation leads to code running outside the Chrome sandbox, bypassing the primary isolation boundary that normally contains renderer compromises.

Root Cause

The root cause is improper type validation in a Rust component within Chrome's Windows build. When incompatible type assumptions cross the safety boundary, memory safety guarantees Rust normally provides no longer hold. See the Chromium issue tracker entry for component-specific details.

Attack Vector

Exploitation requires a victim to load a crafted HTML page in a vulnerable Chrome build. The attacker hosts the payload on a controlled site or delivers it through phishing, malvertising, or a compromised third-party resource. No authentication is required, and the attack is fully remote over the network. User interaction is limited to browsing to the malicious page. Because the compromise escapes the renderer sandbox, follow-on activity can include persistence, credential theft, or lateral movement from the compromised Windows endpoint.

No verified proof-of-concept code is publicly available. See the Chrome Releases advisory for vendor details.

Detection Methods for CVE-2026-87528

Indicators of Compromise

Chrome renderer or browser process (chrome.exe) spawning unexpected child processes such as cmd.exe, powershell.exe, or rundll32.exe
Unsigned or unusual DLLs loaded into chrome.exe shortly after browsing activity
Outbound network connections from Chrome child processes to newly registered or low-reputation domains
Creation of new persistence artifacts (Run keys, scheduled tasks) immediately following a browser session

Detection Strategies

Monitor process lineage where chrome.exe is the parent of native Windows binaries not associated with browser workflows
Correlate browser crash telemetry with subsequent process creation or file write events on the same host
Inventory installed Chrome versions across the fleet and flag any build lower than 153.0.8010.36
Inspect HTTP response bodies for anomalous JavaScript patterns combined with WebAssembly or heavy typed-array manipulation targeting Chrome internals

Monitoring Recommendations

Ingest endpoint process, image load, and network telemetry into a centralized data lake for retrospective hunting
Enable Windows Event Log forwarding for Sysmon events 1, 7, and 11 on user workstations
Track Chrome auto-update status and alert on hosts that stall on outdated versions
Baseline normal Chrome child-process behavior and alert on deviations

How to Mitigate CVE-2026-87528

Immediate Actions Required

Update Google Chrome on all Windows endpoints to version 153.0.8010.36 or later
Force a browser restart after update to ensure the patched binary is loaded into memory
Audit Chromium-based browsers (Edge, Brave, Opera, Vivaldi) and apply their upstream fixes when released
Prioritize patching for high-value users such as administrators, developers, and executives

Patch Information

Google released the fix in the Chrome Stable channel update documented in the Chrome Releases blog post. The fixed version is 153.0.8010.36 for Windows. Verify installed versions by navigating to chrome://settings/help, which triggers an update check and displays the current build.

Workarounds

Enforce Chrome auto-update via enterprise policy and block execution of Chrome versions below 153.0.8010.36
Restrict browsing to trusted sites through URL filtering or secure web gateway policies until patching is complete
Deploy application allowlisting to prevent unexpected child processes from launching under chrome.exe
Reduce user privileges on Windows endpoints to limit post-exploitation impact

bash

# Verify Chrome version on Windows via PowerShell
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# Force Chrome update check via Google Update
& "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ua /installsource scheduler