CVE-2026-87581: Google Chrome Use After Free Vulnerability

CVE-2026-87581 is a use after free vulnerability in Google Chrome Payments that enables remote attackers to execute arbitrary code outside the sandbox through social engineering and crafted HTML pages. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-87581 Overview

CVE-2026-87581 is a use-after-free vulnerability in the Payments component of Google Chrome. The flaw affects versions prior to 153.0.8010.36 and allows a remote attacker to execute arbitrary code outside the browser sandbox. Exploitation requires user interaction and social engineering to lure a victim to a crafted HTML page. Chromium engineers rated the security severity as High, and the CVSS 3.1 score of 9.6 reflects the scope change and full impact on confidentiality, integrity, and availability. The bug is tracked in the Chromium issue tracker as issue #553129531 and was addressed in the Stable channel desktop update.

Critical Impact
Successful exploitation enables arbitrary code execution outside the Chrome sandbox, giving an attacker code execution in the context of the user on the underlying operating system.

Affected Products

Google Chrome for Desktop versions prior to 153.0.8010.36
Chromium-based browsers embedding the vulnerable Payments component
All operating system builds (Windows, macOS, Linux) shipping the affected Chrome Stable channel

Discovery Timeline

2026-09-09 - CVE-2026-87581 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87581

Vulnerability Analysis

The vulnerability is a use-after-free condition [CWE-416] in Chrome's Payments subsystem. Use-after-free bugs occur when code references memory that has already been released back to the allocator. An attacker who controls the freed allocation can steer program flow into attacker-supplied data or objects. In this case, the flaw is reachable from a crafted HTML page that drives the Payments code paths through browser APIs such as the Payment Request API. Because the referenced advisory states the attacker can escape the sandbox, the primitive is strong enough to corrupt objects and execute code outside the renderer's isolated process.

Root Cause

The root cause is improper object lifetime management inside the Payments component. A pointer or handle continues to be used after the underlying object has been freed. Details are restricted in Chromium issue #553129531 pending broad patch adoption.

Attack Vector

An attacker hosts a crafted HTML page and convinces a target to visit it through phishing, malvertising, or a compromised site. The page invokes Payments-related JavaScript flows that trigger the freed allocation and subsequent reuse. The scope change captured in the CVSS vector reflects the sandbox escape, in which code executes with the privileges of the browser process rather than the sandboxed renderer.

No public proof-of-concept, exploit database entry, or CISA KEV listing is currently associated with CVE-2026-87581. See the Chromium Issue Tracker #553129531 for technical references as they become available.

Detection Methods for CVE-2026-87581

Indicators of Compromise

Chrome renderer or browser process crashes with heap corruption signatures shortly after visiting untrusted pages that invoke the Payment Request API
Unexpected child processes spawned by chrome.exe or the Chrome Helper process outside the normal update and utility process patterns
Outbound network connections to unfamiliar domains initiated by the browser process immediately following a payment or checkout flow on an untrusted site

Detection Strategies

Inventory installed Chrome versions across the fleet and alert on any build older than 153.0.8010.36
Correlate browser process crash telemetry with recent navigation history to identify pages triggering repeatable faults in the Payments code path
Monitor for post-exploitation behaviors such as credential access, LSASS interaction, or persistence created by processes with a Chrome parent

Monitoring Recommendations

Ingest browser process telemetry, DNS lookups, and child process creation events into a centralized analytics platform for correlation
Track patch compliance for Chrome and Chromium-based browsers as a first-class metric with alerting on drift
Review web proxy and DNS logs for traffic to newly registered or low-reputation domains served over checkout-styled landing pages

How to Mitigate CVE-2026-87581

Immediate Actions Required

Update Google Chrome to 153.0.8010.36 or later on all Windows, macOS, and Linux endpoints
Restart the browser after the update installs to ensure the patched binaries are loaded into memory
Audit Chromium-based browsers and embedded WebView components for downstream builds that include the vulnerable Payments code

Patch Information

Google released the fix in the Chrome Stable channel desktop update documented in the Google Chrome Stable Update advisory. Administrators should validate that managed installations have pulled the fixed version and force update through enterprise policies where auto-update is disabled.

Workarounds

Enforce Chrome auto-update through group policy or MDM to reduce time-to-patch across managed endpoints
Restrict browsing to trusted destinations using enterprise URL filtering until the update is deployed
Educate users to avoid entering payment flows on untrusted or unsolicited pages received through email or messaging platforms

bash

# Verify installed Chrome version on Windows
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# Verify installed Chrome version on macOS
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString

# Verify installed Chrome version on Linux
google-chrome --version