CVE-2026-87542: Google Chrome Use After Free Vulnerability

CVE-2026-87542 Overview

CVE-2026-87542 is a use-after-free vulnerability in the Input component of Google Chrome. The flaw affects Chrome versions prior to 153.0.8010.36 and allows a remote attacker to execute arbitrary code inside the browser sandbox through a crafted HTML page. Google's Chromium team rated the internal security severity as High. Exploitation requires user interaction, specifically loading attacker-controlled web content. The vulnerability is tracked as CWE-416: Use After Free.

Critical Impact
A remote attacker can trigger arbitrary code execution inside the Chrome renderer sandbox by convincing a user to visit a malicious HTML page.

Affected Products

Google Chrome (Desktop) versions prior to 153.0.8010.36
Chromium-based browsers sharing the vulnerable Input component code
All supported desktop platforms (Windows, macOS, Linux) running affected Chrome builds

Discovery Timeline

2026-09-09 - CVE-2026-87542 published to the National Vulnerability Database (NVD)
2026-09-10 - Last updated in NVD database
Additional vendor details are available in the Chrome Stable Channel Update and Chromium Issue Tracker #542756749

Technical Details for CVE-2026-87542

Vulnerability Analysis

The vulnerability is a use-after-free condition in Chrome's Input component, which handles user input events dispatched through the renderer process. Use-after-free bugs occur when code continues to use a pointer to memory after that memory has been released back to the allocator. An attacker who can influence allocation and deallocation timing during input event processing can cause Chrome to dereference a freed object.

Because the corrupted object typically holds function pointers or virtual table references, controlled reuse of the freed slab lets attackers hijack control flow. Google confirms the resulting code execution is contained within the Chrome renderer sandbox. Attackers commonly chain such renderer bugs with a separate sandbox escape to achieve full compromise of the host.

Root Cause

The underlying defect is an object lifetime management error in the Input subsystem, classified as CWE-416. An object referenced during input handling is freed while a stale pointer remains reachable, allowing a subsequent operation to read or write the reclaimed memory region.

Attack Vector

Exploitation is network-based and requires the victim to load a crafted HTML page. The attacker delivers the page through direct browsing, a compromised website, a malicious advertisement, or an embedded iframe. JavaScript on the page drives the specific event sequence needed to free the target object and then reference it, achieving arbitrary code execution inside the renderer sandbox.

No verified public proof-of-concept has been released. Technical specifics are restricted in Chromium Issue Tracker #542756749 pending broad patch adoption.

Detection Methods for CVE-2026-87542

Indicators of Compromise

Chrome renderer processes crashing with access violations or heap corruption signatures shortly after visiting untrusted pages
Unexpected child processes spawned from chrome.exe following renderer instability
Outbound connections from browser processes to newly registered or low-reputation domains hosting HTML payloads
Endpoint telemetry showing browser processes writing executables or scripts to disk

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag builds earlier than 153.0.8010.36
Correlate browser crash reports with subsequent process creation, file write, or network activity to surface post-exploitation behavior
Apply behavioral rules that identify sandbox-escape patterns such as renderer processes accessing sensitive OS APIs
Hunt for JavaScript exploit primitives (heap grooming, WebAssembly abuse) in HTTP responses using proxy or network detection tooling

Monitoring Recommendations

Ingest Chrome crash and update telemetry into a centralized logging platform for version compliance tracking
Alert on browser processes launching command interpreters (cmd.exe, powershell.exe, /bin/sh)
Monitor DNS and HTTP traffic for connections to attacker infrastructure staging exploit HTML
Track endpoint EDR alerts tagged to browser parent processes for signs of memory corruption exploitation

How to Mitigate CVE-2026-87542

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all Windows, macOS, and Linux endpoints
Force a browser restart after update deployment to ensure the patched binary is loaded
Verify Chromium-based browsers (Edge, Brave, Opera, Vivaldi) have shipped equivalent updates and deploy them
Restrict browsing to trusted sites for high-value users until patch coverage is confirmed

Patch Information

Google released the fix in the Chrome Stable channel at version 153.0.8010.36. Deployment details are documented in the Chrome Stable Channel Update. Enterprise administrators should use Chrome Browser Enterprise policies or existing patch management tooling to enforce the minimum version.

Workarounds

Enable Chrome's Site Isolation and strict Site-per-Process policies to limit cross-origin memory reuse
Deploy browser extension controls and web content filtering to block access to untrusted or newly observed domains
Enforce least-privilege user accounts so renderer compromise cannot easily pivot to administrative actions
Consider temporarily disabling JavaScript on high-risk browsing profiles where compatibility permits

bash

# Verify installed Chrome version against the patched build
google-chrome --version
# Expected: Google Chrome 153.0.8010.36 or later

# Windows enterprise policy example to enforce minimum version via Group Policy
# Registry: HKLM\Software\Policies\Google\Chrome
# Value: TargetVersionPrefix = "153.0.8010.36"