CVE-2026-87529: Google Chrome RCE Vulnerability

CVE-2026-87529 Overview

CVE-2026-87529 is a numeric truncation error in the Media component of Google Chrome. The flaw affects Chrome versions prior to 153.0.8010.36. A remote attacker can potentially execute arbitrary code outside the Chrome sandbox by serving a crafted HTML page to a victim.

The vulnerability is classified under [CWE-197: Numeric Truncation Error]. The Chromium project rated the internal security severity as Medium, though the assigned CVSS vector reflects broader impact including scope change and full compromise of confidentiality, integrity, and availability.

Critical Impact
Successful exploitation allows sandbox escape and arbitrary code execution on the host, triggered by a single visit to an attacker-controlled web page.

Affected Products

Google Chrome versions prior to 153.0.8010.36
Chromium-based browsers incorporating the vulnerable Media component
Desktop Stable channel builds on Windows, macOS, and Linux

Discovery Timeline

2026-09-09 - CVE-2026-87529 published to NVD
2026-09-10 - Last updated in NVD database
2026-09 - Google releases Stable channel update addressing the flaw (Google Chrome Update Blog Post)

Technical Details for CVE-2026-87529

Vulnerability Analysis

The vulnerability resides in Chrome's Media subsystem, which processes audio, video, and container formats parsed from web content. A numeric truncation error occurs when a larger integer value is converted into a smaller type, discarding high-order bits. The resulting truncated value is then used in downstream logic that assumes the original magnitude.

Because the affected code path processes attacker-controlled media data, a crafted HTML page embedding malicious media can drive the Media component into an inconsistent state. According to the Chromium advisory, exploitation can lead to arbitrary code execution outside the sandbox, indicating the flaw enables escape from Chrome's renderer or utility process boundary.

User interaction is required — the victim must visit the malicious page — but no authentication or prior access is needed.

Root Cause

The root cause is improper handling of integer width conversions within the Media component. When a value exceeding the destination type's range is assigned, the truncated result silently wraps. Subsequent size calculations, buffer allocations, or offset computations then operate on incorrect values, producing conditions that can be leveraged for memory corruption and control-flow hijacking.

Attack Vector

An attacker hosts a crafted HTML page containing malicious media content. When a Chrome user loads the page, the Media component parses the content and triggers the truncation flaw. Exploitation chains this primitive with additional logic to escape the sandbox and execute code in the browser process context, which runs with the user's privileges.

Delivery vectors include phishing links, malicious advertisements, compromised legitimate sites, and embedded iframes on attacker-influenced content.

No public proof-of-concept or exploit code is currently listed in ExploitDB, and the CVE is not present on the CISA Known Exploited Vulnerabilities catalog. Technical details are tracked in the Chromium Issue Tracker Entry.

Detection Methods for CVE-2026-87529

Indicators of Compromise

Chrome renderer or utility process crashes with signatures pointing to the Media component around the time of browsing activity.
Unexpected child processes spawned from chrome.exe (Windows) or the Chrome helper processes (macOS, Linux) shortly after page loads.
Outbound connections from Chrome processes to unfamiliar hosts immediately following media-heavy page rendering.

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any build below 153.0.8010.36.
Monitor endpoint telemetry for anomalous process lineage originating from browser processes, including shell, script, or LOLBin execution.
Correlate web proxy logs with endpoint alerts to identify users who visited suspicious pages preceding suspected browser compromise.

Monitoring Recommendations

Enable browser crash reporting and forward crash telemetry to a centralized log store for review.
Track browser version compliance through configuration management and alert on drift from the patched baseline.
Ingest DNS and proxy logs into a SIEM to hunt for known malicious-ad and exploit-kit infrastructure targeting Chrome users.

How to Mitigate CVE-2026-87529

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints without delay.
Force-restart Chrome after deployment to ensure the patched binary is loaded; pending updates do not take effect until browser restart.
Audit Chromium-derived browsers (Edge, Brave, Opera, Vivaldi) and apply their corresponding fixed releases as vendors publish them.

Patch Information

Google released the fix in the Stable channel update documented at the Google Chrome Update Blog Post. The fixed version is 153.0.8010.36. Enterprise administrators should push the update through Chrome Browser Cloud Management, Group Policy, MDM, or the appropriate package manager.

Workarounds

Restrict browsing to trusted sites through web filtering while patch deployment is in progress.
Block or heavily filter third-party advertising networks, a common delivery channel for browser exploits.
Enable Site Isolation and ensure Chrome sandbox protections are not disabled by policy on any managed device.

bash

# Verify installed Chrome version on Linux/macOS endpoints
google-chrome --version

# Windows: query the registry for installed version
reg query "HKLM\SOFTWARE\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Enterprise policy: enforce minimum version and auto-update
# Windows Group Policy (chrome.admx):
#   Computer Configuration > Policies > Administrative Templates >
#   Google > Google Chrome > Google Update > Applications >
#   Google Chrome > Update policy override = "Always allow updates"