CVE-2026-87533: Google Chrome DevTools Use-After-Free

CVE-2026-87533 Overview

CVE-2026-87533 is a use-after-free vulnerability in the DevTools component of Google Chrome prior to version 153.0.8010.36. The flaw allows a local attacker to execute arbitrary code outside the Chrome sandbox by leveraging a local program. Google's Chromium team rated the security severity as Medium, while the National Vulnerability Database assigns a higher score based on scope and impact metrics. The vulnerability is tracked under CWE-416: Use After Free and affects desktop builds of Chrome across supported operating systems.

Critical Impact
Successful exploitation permits arbitrary code execution outside the Chrome sandbox, breaking the primary containment boundary that isolates renderer processes from the host operating system.

Affected Products

Google Chrome Desktop versions prior to 153.0.8010.36
Chromium-based browsers incorporating the vulnerable DevTools component
Windows, macOS, and Linux Chrome Stable channel builds prior to the fixed release

Discovery Timeline

2026-09-09 - CVE-2026-87533 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87533

Vulnerability Analysis

The vulnerability resides in Chrome's DevTools subsystem, which provides developer inspection and debugging features tightly integrated with the browser process. A use-after-free condition [CWE-416] occurs when the DevTools code references a memory object after it has been freed. An attacker who controls a local program can influence object lifetime and trigger the dangling reference. The condition enables arbitrary code execution outside the Chrome sandbox because DevTools operates with elevated privileges relative to renderer processes.

Root Cause

The root cause is improper object lifetime management within DevTools. A pointer or reference continues to be used after the underlying memory has been released back to the allocator. When the freed region is reallocated with attacker-controlled data, subsequent operations on the stale reference redirect execution or corrupt program state. Chromium security engineers documented the flaw in Chromium Issue Tracker #521620916.

Attack Vector

Exploitation requires local access and a supporting program that interacts with Chrome DevTools. The attacker triggers the free of a DevTools-managed object, reclaims the memory with crafted content, then forces reuse of the stale reference. Because the flaw permits escape from the sandbox, code executes in the security context of the browser process rather than the confined renderer. Attack complexity is high, and no user interaction is required beyond initial local execution.

No public proof-of-concept or exploit code is available. See the Chromium Issue Tracker entry for technical detail released by the vendor.

Detection Methods for CVE-2026-87533

Indicators of Compromise

Unexpected Chrome browser processes spawning child processes with unusual command lines or writing to non-standard paths.
Local programs interacting with Chrome DevTools protocol endpoints on localhost outside of legitimate developer workflows.
Chrome crash reports referencing DevTools modules with heap corruption or access violation signatures.

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any host running a build earlier than 153.0.8010.36.
Monitor process creation events where chrome.exe launches unusual descendants such as script interpreters or command shells.
Alert on connections to the Chrome DevTools Protocol port --remote-debugging-port from non-developer accounts.

Monitoring Recommendations

Ingest endpoint process telemetry and browser crash logs into a central data lake for retrospective hunting.
Correlate local program execution with Chrome DevTools activity to surface abuse patterns.
Track patch compliance for browser software using vulnerability management dashboards.

How to Mitigate CVE-2026-87533

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints.
Verify auto-update is enabled and functioning for Chrome and Chromium-based browsers in the environment.
Restrict local administrative access to reduce the population of users who could stage the required local program.

Patch Information

Google released the fixed build in the Stable channel. Refer to the Google Chrome Stable Update advisory for release details. Enterprise administrators should push the update through Chrome Browser Cloud Management, Group Policy, or their standard software distribution tooling.

Workarounds

Disable or restrict use of Chrome DevTools on production endpoints using the DeveloperToolsAvailability enterprise policy.
Prevent unauthorized local programs from executing through application allowlisting until patching completes.
Isolate developer workstations that require DevTools access from broader corporate networks.

bash

# Configuration example: Chrome enterprise policy to restrict DevTools on Windows
# Registry path: HKLM\SOFTWARE\Policies\Google\Chrome
# Value name: DeveloperToolsAvailability
# Value type: REG_DWORD
# Value data: 2  (disallow DevTools on all URLs)
reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v DeveloperToolsAvailability /t REG_DWORD /d 2 /f