CVE-2026-87536: Google Chrome V8 Use After Free Vulnerability

CVE-2026-87536 Overview

CVE-2026-87536 is a use-after-free vulnerability in the V8 JavaScript engine used by Google Chrome. Versions prior to 153.0.8010.36 are affected. A remote attacker can execute arbitrary code inside the Chrome sandbox by convincing a user to visit a crafted HTML page. Chromium classifies the security severity as High.

The flaw is tracked under CWE-416: Use After Free and requires user interaction to trigger. Exploitation delivers code execution constrained by the renderer sandbox, which attackers commonly chain with a sandbox escape to achieve full compromise.

Critical Impact
Remote code execution inside the Chrome renderer sandbox via a crafted web page, enabling browser compromise and a foothold for sandbox escape chains.

Affected Products

Google Chrome desktop versions prior to 153.0.8010.36
Chromium-based browsers embedding vulnerable V8 builds
Any application bundling the affected V8 engine version

Discovery Timeline

2026-09-09 - CVE-2026-87536 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87536

Vulnerability Analysis

The vulnerability resides in V8, the JavaScript and WebAssembly engine that powers Chrome. A use-after-free condition occurs when the engine references a heap object after that object has already been freed. An attacker who controls the allocation and deallocation sequence can reclaim the freed memory with attacker-controlled data.

Once the dangling pointer is dereferenced, V8 operates on attacker-shaped memory. This enables type confusion, arbitrary read and write primitives, and ultimately arbitrary code execution within the renderer process.

The affected code paths are reachable from standard JavaScript executed on a web page. Because V8 is compiled with just-in-time (JIT) code generation, adversaries can pivot from a memory corruption primitive to a stable exploit chain in the renderer.

Root Cause

The root cause is improper object lifetime management inside V8. A code path releases a heap object while another reference to that object remains reachable. Subsequent operations on the stale reference trigger the use-after-free. Full technical details are restricted; see the Chromium Issue Tracker Entry once access is granted.

Attack Vector

Exploitation is network-based and requires user interaction. A victim must load attacker-controlled HTML and JavaScript in a vulnerable Chrome build. Common delivery paths include phishing links, compromised advertising networks, watering-hole sites, and malicious iframes embedded in otherwise trusted pages.

Code execution is initially bounded by the renderer sandbox. Attackers typically pair renderer use-after-free bugs with a separate sandbox escape to achieve arbitrary code execution on the host.

No public proof-of-concept, exploit code, or CISA KEV listing is associated with CVE-2026-87536 at the time of publication. The EPSS probability is 0.268%.

Detection Methods for CVE-2026-87536

Indicators of Compromise

Chrome renderer processes crashing with access violations shortly after loading external content
Unexpected child processes spawned by chrome.exe or the renderer helper on macOS and Linux
Outbound connections from browser processes to newly registered or low-reputation domains hosting heavy JavaScript payloads
Browser telemetry showing V8 JIT crashes referencing freed heap objects

Detection Strategies

Inventory installed Chrome and Chromium-derivative versions and flag builds below 153.0.8010.36
Alert on renderer process crashes correlated with recent navigation events in endpoint telemetry
Inspect HTTP responses for obfuscated JavaScript that manipulates typed arrays, ArrayBuffers, or WebAssembly memory in patterns consistent with V8 exploitation
Correlate browser process anomalies with subsequent process injection or credential access behavior

Monitoring Recommendations

Ingest browser process telemetry, network flows, and DNS logs into a central data lake for correlation
Monitor for post-exploitation activity such as unsigned binary execution, LSASS access, and unusual persistence entries following browser sessions
Track patch coverage in near real time and enforce version compliance through management tooling

How to Mitigate CVE-2026-87536

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints
Restart Chrome after the update to ensure the patched binary is loaded into memory
Audit Chromium-based browsers and embedded webviews for vulnerable V8 builds and update them from vendor channels
Enforce browser update policies through mobile device management or group policy to prevent version drift

Patch Information

Google addressed the vulnerability in the Chrome Stable channel release documented in the Google Chrome Stable Update advisory. Users on 153.0.8010.36 or later on the Stable channel are protected. Enterprises should validate deployment through their patch management systems and confirm that older cached versions are removed.

Workarounds

Restrict browsing to trusted sites via enterprise web filtering until patches are deployed
Deploy content-security policies and script controls that reduce exposure to attacker-controlled JavaScript
Isolate high-risk browsing in a hardened virtual machine or remote browser isolation service
Disable JavaScript on untrusted origins where operationally feasible

bash

# Verify installed Chrome version on Windows
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Verify installed Chrome version on Linux
google-chrome --version