CVE-2026-87564: Google Chrome V8 Information Disclosure

CVE-2026-87564 Overview

CVE-2026-87564 is a type confusion vulnerability in the V8 JavaScript engine used by Google Chrome prior to version 153.0.8010.36. A remote attacker can read memory inside the V8 sandbox by convincing a user to visit a crafted HTML page. The flaw is tracked under CWE-843 (Access of Resource Using Incompatible Type). Google rates the underlying Chromium issue as High severity, while NVD scores the CVE as Medium because impact is limited to memory disclosure inside the sandbox.

Critical Impact
Remote attackers can read sensitive in-process memory from V8's sandboxed heap by luring a target to a malicious web page, enabling information leakage useful for chaining further browser exploits.

Affected Products

Google Chrome for Desktop prior to 153.0.8010.36
Chromium-based browsers embedding a vulnerable V8 build
Downstream distributions shipping the pre-patch Chrome Stable channel

Discovery Timeline

2026-09-09 - CVE-2026-87564 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87564

Vulnerability Analysis

The vulnerability resides in V8, Chrome's JavaScript and WebAssembly engine. V8 relies on precise type tracking as it optimizes and executes JIT-compiled code. When the engine treats an object as one type while its underlying representation is another, memory can be interpreted incorrectly. This type confusion produces an out-of-type read that exposes bytes from adjacent sandboxed objects. Exploitation requires user interaction, specifically loading a crafted HTML page, and does not require prior authentication.

The read stays within the V8 sandbox, which limits direct impact to confidentiality of in-process JavaScript heap data. Leaked pointers, object headers, or partial memory contents are commonly used to defeat address-space layout randomization (ASLR) or as a stepping stone in multi-bug browser exploit chains.

Root Cause

Type confusion (CWE-843) occurs when code assumes an object matches a specific type without verifying that assumption. In V8, optimized code paths can retain stale type assumptions after transitions such as map deprecations, hidden class changes, or feedback-vector updates. Executing a specially crafted JavaScript sequence forces the optimizer to operate on an object whose actual layout differs from the expected one, permitting an out-of-bounds or mistyped read inside the sandbox.

Attack Vector

An attacker hosts a malicious HTML page that serves JavaScript designed to trigger the type confusion. When a Chrome user visits the page, the crafted script drives V8 into the vulnerable state and reads memory from within the V8 sandbox. No credentials are required, and delivery can occur through phishing links, malicious advertisements, or compromised sites. Details of the specific trigger are restricted in the Chromium Issue Tracker Entry until a majority of users have updated.

A public proof of concept has not been released, and CISA has not added the CVE to the Known Exploited Vulnerabilities catalog. Refer to the Chromium Blog Update for release notes.

Detection Methods for CVE-2026-87564

Indicators of Compromise

Chrome browser processes running versions earlier than 153.0.8010.36 after the patch release window
Navigation events to unfamiliar domains hosting heavily obfuscated JavaScript that manipulates typed arrays or WebAssembly objects
Renderer process anomalies such as unexpected crashes or repeated V8 sandbox faults immediately following page loads

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build below 153.0.8010.36.
Correlate web proxy logs with endpoint telemetry to identify users who visited suspicious pages while running vulnerable Chrome versions.
Hunt for renderer child processes spawning unusual downloads or IPC patterns after visiting external sites.

Monitoring Recommendations

Ingest browser version telemetry into the security data lake and alert on drift from the approved patched build.
Monitor endpoint DNS and HTTP telemetry for domains associated with malvertising or exploit-kit infrastructure.
Track Chrome crash reports and Windows Error Reporting entries referencing v8.dll or renderer sandbox violations.

How to Mitigate CVE-2026-87564

Immediate Actions Required

Update Google Chrome to 153.0.8010.36 or later on all supported operating systems.
Restart Chrome after patching to ensure the vulnerable V8 module is unloaded from memory.
Push the update through enterprise management tooling such as Chrome Browser Cloud Management or Group Policy to enforce compliance.
Validate that Chromium-based browsers and embedded WebViews in the environment consume the patched V8 build.

Patch Information

Google released the fix in the Chrome Stable channel version 153.0.8010.36. See the Chromium Blog Update for the full advisory and the Chromium Issue Tracker Entry for tracking metadata. Downstream Chromium-based browsers should ship equivalent V8 fixes on their next release cycle.

Workarounds

No official workaround exists; patching is the only complete remediation.
Restrict browsing to trusted sites via enterprise URL allowlists until updates are deployed.
Use site isolation and disable JIT compilation in Chrome (--js-flags="--jitless") on high-risk endpoints to reduce the attack surface, accepting the performance impact.

bash

# Verify installed Chrome version on Linux/macOS
google-chrome --version

# Windows: query the installed version from the registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# Enterprise policy example (Windows Group Policy registry key)
# Force automatic updates for Chrome
reg add "HKLM\SOFTWARE\Policies\Google\Update" /v UpdateDefault /t REG_DWORD /d 1 /f