CVE-2026-87572 Overview
CVE-2026-87572 is an injection vulnerability in the DevTools component of Google Chrome versions prior to 153.0.8010.36. A remote attacker who has already compromised the renderer process can escape the Chrome sandbox and execute arbitrary code on the host by serving a crafted HTML page. Google's Chromium team rated this issue High severity. The flaw is classified under CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component. Exploitation requires user interaction and a prior renderer compromise, but a successful chain results in code execution outside the sandbox.
Critical Impact
Sandbox escape leading to arbitrary code execution on the host operating system, enabling attackers to break Chrome's primary security boundary.
Affected Products
- Google Chrome (Desktop) versions prior to 153.0.8010.36
- Chromium-based builds embedding vulnerable DevTools components
- All supported desktop platforms (Windows, macOS, Linux) shipping the affected Stable channel build
Discovery Timeline
- 2026-09-09 - CVE-2026-87572 published to NVD
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-87572
Vulnerability Analysis
The vulnerability resides in Chrome's DevTools front-end, which runs at higher privilege than a standard renderer. DevTools communicates with the browser process over a privileged channel used to inspect and control pages. When DevTools processes attacker-influenced content without proper neutralization, injected markup or script executes in the DevTools context. That context has access to APIs the sandbox is meant to isolate from web content.
An attacker must first compromise the renderer process, typically through a separate memory-corruption or logic bug. From that foothold, a crafted HTML page delivered through DevTools interactions injects code that runs outside the renderer sandbox. The result is arbitrary code execution in a higher-privilege browser context, defeating Chrome's site isolation and sandbox boundaries. See the Chromium issue tracker entry for reference metadata.
Root Cause
The root cause is improper neutralization of special elements passed into DevTools output ([CWE-74]). Untrusted input reaches a downstream DevTools component that interprets it as code or markup rather than data. This injection sink converts renderer-controlled strings into executable content within the privileged DevTools frame.
Attack Vector
Exploitation follows a two-stage chain. First, the attacker compromises the renderer through a separate vulnerability or malicious script. Second, the attacker serves a crafted HTML page that triggers the DevTools injection sink, causing code execution outside the sandbox. User interaction is required, consistent with the CVSS UI:R metric.
No verified public proof-of-concept is available for CVE-2026-87572.
Refer to the Chromium issue tracker and Google's stable channel advisory
for authoritative technical details once access restrictions are lifted.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-87572
Indicators of Compromise
- Chrome processes spawning unexpected child processes such as cmd.exe, powershell.exe, or shell interpreters from a browser context
- Unusual file writes or persistence entries created by chrome.exe outside standard profile directories
- Outbound network connections from Chrome to unfamiliar hosts immediately after visiting untrusted pages
Detection Strategies
- Hunt for renderer-to-browser process anomalies where DevTools frames load content from untrusted origins
- Monitor endpoints for Chrome versions below 153.0.8010.36 using software inventory data
- Correlate browser exploitation patterns with subsequent process creation and command-line telemetry
Monitoring Recommendations
- Enable command-line and process-creation logging on all endpoints running Chrome
- Ingest browser telemetry and process lineage into a SIEM for behavioral correlation
- Alert on Chrome processes loading unsigned modules or performing script interpreter execution
How to Mitigate CVE-2026-87572
Immediate Actions Required
- Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints
- Verify enterprise policy pushes the Stable channel update within the standard patch window
- Audit Chromium-based applications and embedded browser components for the fixed version
Patch Information
Google addressed the vulnerability in the Chrome Stable channel release documented in the Google Chrome Stable Channel Update. Administrators should confirm deployment through chrome://settings/help or centralized update management. Downstream Chromium-based browsers should be updated once vendors incorporate the fix.
Workarounds
- Restrict use of Chrome DevTools on production endpoints via enterprise policy where feasible
- Limit browsing to trusted origins and block untrusted script execution using enterprise browser controls
- Apply strict application allowlisting to prevent execution of secondary payloads dropped by a browser exploit
# Verify installed Chrome version on Linux endpoints
google-chrome --version
# Enterprise policy example: disable Developer Tools where policy permits
# /etc/opt/chrome/policies/managed/disable_devtools.json
{
"DeveloperToolsAvailability": 2
}
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
