CVE-2026-87585 Overview
CVE-2026-87585 is a double free vulnerability [CWE-415] in the PDFium component of Google Chrome on Windows. The flaw affects Chrome versions prior to 153.0.8010.36. A remote attacker can exploit the issue by delivering a crafted PDF file to a targeted user. Successful exploitation allows arbitrary code execution within the Chrome sandbox. The Chromium project rated the security severity as High, and the CVSS 3.1 base score is 8.8.
Critical Impact
Attackers can execute arbitrary code inside the Chrome sandbox on Windows endpoints by convincing users to open or render a malicious PDF document.
Affected Products
- Google Chrome versions prior to 153.0.8010.36 on Windows
- Microsoft Windows platforms running vulnerable Chrome builds
- Chromium-based browsers embedding the affected PDFium component
Discovery Timeline
- 2026-09-09 - CVE-2026-87585 published to NVD
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-87585
Vulnerability Analysis
The vulnerability resides in PDFium, the open-source PDF rendering engine used by Google Chrome. PDFium parses and renders PDF documents in a dedicated renderer process. A double free condition occurs when the same heap allocation is released twice during PDF processing. This corrupts heap metadata and allocator state.
An attacker who controls the freed object between the two free() operations can manipulate heap layout. This manipulation can lead to arbitrary code execution inside the sandboxed renderer. Exploitation requires user interaction, such as opening a crafted PDF or visiting a page that renders one.
The attack does not require authentication and can be delivered over the network. Code execution is confined to the Chrome sandbox, meaning an attacker must chain a sandbox escape to gain broader host access.
Root Cause
The root cause is improper lifetime management of a heap-allocated object in PDFium. The affected code path releases memory and then releases it again through a stale reference. This maps directly to CWE-415 (Double Free).
Attack Vector
Delivery vectors include malicious websites that embed or auto-load crafted PDFs, phishing emails with PDF attachments, and third-party applications that use Chromium components to render PDF content. A single user interaction is sufficient to trigger the vulnerable code path.
No public proof-of-concept or exploit code has been published. Technical details are tracked in Chromium Issue #540817065.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-87585
Indicators of Compromise
- Unexpected crashes or renderer process terminations in Chrome shortly after PDF rendering, visible in Windows Event Log and Chrome crash reports.
- PDF files with malformed cross-reference tables, unusual object streams, or crafted JavaScript actions delivered from untrusted sources.
- Chrome renderer processes spawning unexpected child processes or performing anomalous network connections after opening a PDF.
Detection Strategies
- Inventory installed Chrome versions across Windows endpoints and flag any build below 153.0.8010.36.
- Inspect email gateways and web proxies for PDF attachments originating from low-reputation sources.
- Correlate browser crash telemetry with recent PDF downloads or navigation events to identify potential exploitation attempts.
Monitoring Recommendations
- Enable Chrome enterprise reporting to centralize version, extension, and crash telemetry.
- Monitor endpoint process trees for chrome.exe renderer processes spawning cmd.exe, powershell.exe, or other living-off-the-land binaries.
- Alert on writes to autorun locations or scheduled task creation initiated from a Chrome process context.
How to Mitigate CVE-2026-87585
Immediate Actions Required
- Update Google Chrome on all Windows endpoints to version 153.0.8010.36 or later.
- Restart Chrome after applying the update to ensure the vulnerable PDFium code is unloaded from memory.
- Audit Chromium-based browsers and embedded webviews for the same PDFium version and patch accordingly.
Patch Information
Google released the fix in Chrome Stable channel version 153.0.8010.36 for Windows. Refer to the Google Chrome Stable Update advisory for release details and to Chromium Issue #540817065 for technical tracking.
Workarounds
- Disable Chrome's built-in PDF viewer via the AlwaysOpenPdfExternally enterprise policy until patching is complete.
- Block inbound PDF attachments from external senders at the email gateway for high-risk user groups.
- Restrict web browsing to trusted domains through DNS filtering or secure web gateways to reduce exposure to crafted PDFs.
# Configuration example: enforce minimum Chrome version via Windows Group Policy
# Registry path for Chrome enterprise policy
reg add "HKLM\Software\Policies\Google\Chrome" /v AlwaysOpenPdfExternally /t REG_DWORD /d 1 /f
# Verify installed Chrome version on Windows endpoints
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
