CVE-2026-87558: Google Chrome Use After Free Vulnerability

CVE-2026-87558 Overview

CVE-2026-87558 is a use-after-free vulnerability in the Payments component of Google Chrome on macOS. The flaw affects Chrome versions prior to 153.0.8010.36. A remote attacker can exploit the issue by convincing a user to visit a crafted HTML page. Successful exploitation allows arbitrary code execution outside the Chrome sandbox. The vulnerability is tracked under [CWE-416] and carries a Chromium security severity rating of High.

Critical Impact
Remote attackers can escape the Chrome sandbox and execute arbitrary code on macOS systems with a single crafted web page and minimal user interaction.

Affected Products

Google Chrome on macOS prior to 153.0.8010.36
Apple macOS (all supported versions running vulnerable Chrome builds)
Chromium-based configurations that share the vulnerable Payments code path

Discovery Timeline

2026-09-09 - CVE-2026-87558 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87558

Vulnerability Analysis

The vulnerability resides in Chrome's Payments subsystem, which handles the Payment Request API and related payment handler flows. A use-after-free condition occurs when the browser continues to reference an object in memory after that object has been freed. Attackers who control the allocation and reuse pattern can place attacker-controlled data in the freed region.

What distinguishes this issue from a typical renderer-scoped bug is the sandbox-escape impact. Exploitation yields code execution outside the Chrome sandbox, meaning the attacker obtains the privileges of the browser process on macOS rather than the constrained renderer. This eliminates one of Chrome's primary defense-in-depth boundaries.

Because the trigger is a crafted HTML page, the attack surface includes any drive-by scenario: malicious ads, compromised websites, phishing links, or embedded iframes on otherwise legitimate sites. User interaction is required, consistent with clicking or interacting with a payment flow.

Root Cause

The root cause is improper object lifetime management within the Payments component. An object is freed while a dangling pointer or reference remains reachable through another code path. Subsequent access dereferences the stale pointer, permitting memory corruption. Refer to the Chromium Issue Tracker entry for implementation-specific details as they become public.

Attack Vector

The attack is network-based and requires user interaction. An attacker hosts or injects a crafted HTML page that invokes Payments APIs in a sequence designed to trigger the free-and-reuse condition. Once memory corruption is achieved, the attacker chains it with additional primitives to escape the sandbox and run native code on the host.

No public proof-of-concept, exploit, or CISA KEV listing is currently associated with CVE-2026-87558. Technical specifics beyond the vendor advisory should be consulted directly through the Chrome Desktop Update Announcement.

Detection Methods for CVE-2026-87558

Indicators of Compromise

Chrome browser processes on macOS spawning unexpected child processes such as shells, osascript, or curl immediately after web browsing activity.
Unexpected outbound connections initiated by the Chrome parent process to previously unseen infrastructure following visits to payment-related pages.
Crash reports or ReportCrash entries referencing the Payments component or content_shell modules on macOS endpoints.

Detection Strategies

Inventory installed Chrome versions across the macOS fleet and flag any host running a build earlier than 153.0.8010.36.
Alert on Chrome process trees that deviate from expected behavior, particularly renderer or browser processes launching interpreters, debuggers, or file-write utilities.
Correlate browser telemetry with proxy or DNS logs to identify user visits to newly registered or low-reputation domains that host payment or checkout content.

Monitoring Recommendations

Ingest macOS Unified Log and EDR telemetry into a centralized data lake for retrospective hunting against Chrome process lineage.
Track Chrome auto-update status through MDM tooling and alert on hosts that fail to reach the patched build within an enforced window.
Monitor for .dylib loads or code-signing anomalies in Chrome process memory that suggest post-exploitation injection.

How to Mitigate CVE-2026-87558

Immediate Actions Required

Update Google Chrome on all macOS endpoints to version 153.0.8010.36 or later without delay.
Force-restart Chrome after update deployment to ensure the vulnerable binary is no longer resident in memory.
Validate patch coverage through MDM or endpoint management reporting and quarantine hosts that cannot be updated.

Patch Information

Google has released a fix in Chrome Stable channel version 153.0.8010.36 for macOS. Details are published in the Chrome Desktop Update Announcement. Administrators managing Chromium-derived browsers should confirm that their vendor has merged the corresponding upstream fix.

Workarounds

Restrict browsing to trusted sites via web proxy or DNS filtering until patching completes.
Disable the Payment Request API through enterprise policy where business processes do not require it.
Enforce site isolation and strict script controls via Chrome enterprise policies to reduce the exploitability window.

bash

# Verify installed Chrome version on macOS endpoints
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Example MDM query to identify hosts below the patched build
mdmctl query --app "Google Chrome" --version-less-than 153.0.8010.36