CVE-2026-87587: Google Chrome V8 Use-After-Free Vulnerability

CVE-2026-87587 Overview

CVE-2026-87587 is a use-after-free vulnerability in the V8 JavaScript engine used by Google Chrome. The flaw affects Chrome versions prior to 153.0.8010.36. A remote attacker can execute arbitrary code inside the Chrome sandbox by convincing a user to load a crafted HTML page. Google classified the Chromium security severity as High. The vulnerability is tracked under CWE-416 and requires user interaction to trigger.

Critical Impact
Successful exploitation grants an attacker arbitrary code execution inside the Chrome renderer sandbox, providing a primary vector for browser compromise and a foothold for sandbox escape chains.

Affected Products

Google Chrome (Desktop) prior to 153.0.8010.36
Chromium-based browsers embedding vulnerable V8 builds
Downstream distributions shipping Chrome versions earlier than 153.0.8010.36

Discovery Timeline

2026-09-09 - CVE-2026-87587 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87587

Vulnerability Analysis

The vulnerability resides in V8, the JavaScript and WebAssembly engine that powers Chrome. A use-after-free condition occurs when V8 continues to reference memory that has already been released. An attacker who controls the freed memory region can influence engine state and, when the dangling pointer is used, redirect execution or corrupt object metadata.

Because V8 processes untrusted JavaScript from any visited web page, exposure is broad. Exploitation targets renderer-process code executing inside the Chrome sandbox. This means initial code execution is confined to sandbox restrictions, but the primitive is a common building block in multi-stage exploits chained with a sandbox escape.

The attack requires the victim to load a crafted HTML page. No authentication is needed. The attack complexity is low, aligning with typical drive-by browser exploitation.

Root Cause

The issue is classified as [CWE-416]: Use After Free. V8 releases an object while still holding a reference that is dereferenced later during script execution. Attacker-controlled JavaScript triggers the race between deallocation and reuse, then reclaims the freed slab with attacker-crafted data.

Attack Vector

An attacker hosts a malicious HTML page containing JavaScript designed to trigger the use-after-free in V8. The victim visits the page through a phishing link, malvertising, or a compromised site. When the crafted script executes, V8 dereferences freed memory and the attacker gains arbitrary code execution inside the renderer sandbox.

No public exploit or proof-of-concept is currently listed for CVE-2026-87587. Refer to the Chromium Issue Tracker entry for technical details as they become available.

Detection Methods for CVE-2026-87587

Indicators of Compromise

Chrome renderer processes crashing with access violations shortly after visiting untrusted pages
Unexpected child processes spawned by chrome.exe following browser sessions on external content
Outbound connections from Chrome renderer processes to newly registered or low-reputation domains
Presence of Chrome versions earlier than 153.0.8010.36 on managed endpoints

Detection Strategies

Inventory installed Chrome versions across endpoints and flag any build below 153.0.8010.36
Monitor for renderer crashes tagged with V8 stack frames in Windows Error Reporting or crashpad telemetry
Correlate browser process anomalies with recent navigation events to attribute suspicious activity to a specific URL

Monitoring Recommendations

Ingest browser process telemetry and DNS logs into a central data lake for cross-session correlation
Alert on Chrome renderer processes performing file writes to user-writable persistence locations
Track patch compliance for Chrome as part of standard vulnerability management reporting

How to Mitigate CVE-2026-87587

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints
Force a browser restart to ensure the patched V8 build is loaded into memory
Audit Chromium-based applications and Electron builds for the vulnerable V8 revision and update accordingly
Restrict browsing to trusted sites for users who cannot be patched immediately

Patch Information

Google addressed CVE-2026-87587 in the Chrome Stable channel release documented in the Google Chrome Stable Update advisory. Upgrading to 153.0.8010.36 or later remediates the use-after-free in V8.

Workarounds

Enable Chrome enterprise policy ComponentUpdatesEnabled to guarantee automatic V8 component updates
Deploy Site Isolation and Strict Site Isolation policies to reduce the impact of renderer compromise
Use browser isolation or remote browser technology for high-risk user groups until patching completes
Block access to unclassified or newly registered domains at the web proxy to reduce exposure to malicious HTML

bash

# Verify installed Chrome version on Windows
reg query "HKLM\SOFTWARE\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Verify installed Chrome version on macOS
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString

# Verify installed Chrome version on Linux
google-chrome --version