CVE-2026-87578: Google Chrome Use-After-Free Vulnerability

CVE-2026-87578 Overview

CVE-2026-87578 is a use-after-free vulnerability [CWE-416] in the Receiver component of Google Chrome prior to version 153.0.8010.36. An adjacent network attacker can execute arbitrary code outside the Chrome sandbox by sending crafted network traffic. Google's Chromium security team rated the internal severity as High.

The flaw enables sandbox escape, which removes a core browser security boundary. Successful exploitation gives an attacker code execution in the context of the browser process on the victim host. Google addressed the issue in the Stable channel update released through the Chrome Releases blog.

Critical Impact
Arbitrary code execution outside the Chrome sandbox from an adjacent network position, without user interaction or authentication.

Affected Products

Google Chrome Desktop (Windows, macOS, Linux) prior to 153.0.8010.36
Chromium-based browsers embedding the vulnerable Receiver component
Any downstream distribution pinned to a pre-153.0.8010.36 Chrome build

Discovery Timeline

2026-09-09 - CVE-2026-87578 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87578

Vulnerability Analysis

The defect is a use-after-free condition in the Receiver component, which handles incoming inter-process or network message dispatching within Chrome. When the referenced object is released while an outstanding reference remains reachable, subsequent operations dereference freed memory. An attacker who controls the timing and contents of that memory region can hijack control flow.

Because the vulnerable code path executes outside the renderer sandbox, successful exploitation results in code execution in a higher-privileged browser process. This bypasses the site-isolation and sandboxing model that normally contains renderer compromises. The attacker must sit on an adjacent network segment reachable by the victim's browser stack.

Root Cause

The root cause is object lifetime mismanagement inside the Receiver implementation. A callback or message handler retains a raw pointer or weak binding to an object that another code path has already destroyed. Reuse of the stale reference yields the classic use-after-free primitive tracked as [CWE-416].

Attack Vector

Exploitation requires an adjacent network position, which typically means the same broadcast domain, Wi-Fi network, or link-local segment as the victim. No authentication and no user interaction are required. The attacker delivers crafted network traffic that the Receiver component parses, triggering the freed-object reuse and enabling arbitrary code execution outside the sandbox. Attack complexity is high because reliable exploitation depends on controlling allocator state and race timing.

No public proof-of-concept, exploit code, or CISA KEV listing exists for CVE-2026-87578 at the time of publication. Technical details tracked in Chromium Issue Tracker #517371367 remain access-restricted per Google's standard disclosure policy.

Detection Methods for CVE-2026-87578

Indicators of Compromise

Unexpected child processes spawned by chrome.exe or the Chrome browser process on macOS and Linux
Chrome browser process crashes with heap corruption signatures logged near network receive events
Outbound connections from Chrome processes to hosts not associated with browsing activity
Unusual link-local or multicast traffic targeting endpoints running unpatched Chrome versions

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any build below 153.0.8010.36
Monitor endpoint telemetry for anomalous process creation chains descending from Chrome browser processes
Correlate Chrome crash dumps with concurrent inbound traffic on adjacent network segments
Alert on Chrome processes performing file writes or module loads outside standard profile directories

Monitoring Recommendations

Enable EDR process-lineage and memory-integrity telemetry on all workstations running Chrome
Ingest browser crash reports into the SIEM and correlate with network capture metadata
Track version compliance continuously and alert when endpoints fall behind the fixed build

How to Mitigate CVE-2026-87578

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all Windows, macOS, and Linux endpoints
Restart Chrome after the update to ensure the patched binaries are loaded into memory
Verify downstream Chromium-based browsers have absorbed the upstream fix before considering the risk closed
Prioritize patching for hosts on shared or untrusted Wi-Fi networks where adjacent attackers are more plausible

Patch Information

Google released the fix in the Stable channel update announced on the Google Chrome Stable Update blog. The fixed version is 153.0.8010.36. Enterprises using managed deployments should push the update through Chrome Browser Cloud Management, Group Policy, or their MDM of choice.

Workarounds

Restrict Chrome usage on untrusted networks such as public Wi-Fi until the patched build is deployed
Segment client networks to limit adjacent-network exposure between user endpoints
Disable local network discovery features and mDNS where operationally acceptable to shrink the attack surface

bash

# Verify installed Chrome version on Linux
google-chrome --version

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Windows: query registry for installed version
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version