CVE-2026-87588: Google Chrome Use After Free Vulnerability

CVE-2026-87588 Overview

CVE-2026-87588 is a use-after-free vulnerability [CWE-416] in the Chromecast component of Google Chrome. The flaw affects Chrome versions prior to 153.0.8010.36. A remote attacker can execute arbitrary code inside the Chrome sandbox by tricking a user into visiting a crafted HTML page. Google's Chromium security team rated the underlying issue as Medium, while the NVD scoring reflects a higher network-based impact profile.

Critical Impact
Successful exploitation allows arbitrary code execution within the renderer sandbox, providing an attacker with a foothold that can be chained with a sandbox escape for full system compromise.

Affected Products

Google Chrome (Desktop) versions prior to 153.0.8010.36
Chromium-based browsers embedding the vulnerable Chromecast component
Chrome Stable channel builds released before the September 2026 update

Discovery Timeline

2026-09-09 - CVE-2026-87588 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87588

Vulnerability Analysis

The vulnerability resides in Chrome's Chromecast subsystem, which manages media casting sessions to Google Cast receiver devices. A use-after-free condition occurs when the component references memory that has already been released. An attacker who controls a crafted HTML page can trigger the freed object reuse and gain arbitrary code execution inside the renderer sandbox.

Use-after-free flaws in Chrome components historically enable reliable exploitation through heap grooming and JavaScript primitives. The attack requires user interaction, meaning the victim must load attacker-controlled content in a vulnerable browser. Sandbox-contained code execution is typically paired with a secondary sandbox escape to achieve full host compromise.

Root Cause

The root cause is improper object lifetime management [CWE-416] in the Chromecast component. Code paths retain and dereference a pointer after the underlying object has been deallocated. Consult the Chromium Issue Tracker Entry for restricted technical detail once Google unrestricts the ticket.

Attack Vector

Exploitation is network-based and requires user interaction. The attacker hosts a malicious page that invokes Chromecast APIs in a sequence that triggers the freed-memory reference. No authentication is required. Delivery vectors include phishing links, malvertising, and compromised web properties.

No public proof-of-concept or exploit code is available at the time of publication. See the Google Chrome Stable Update advisory for release notes.

Detection Methods for CVE-2026-87588

Indicators of Compromise

Chrome renderer process crashes referencing the Chromecast or Media Router modules preceding suspicious child process activity
Unexpected outbound connections from chrome.exe to attacker-controlled infrastructure after visiting untrusted pages
Browser child processes spawning shell interpreters (cmd.exe, powershell.exe, /bin/sh) without user-initiated download workflows

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any build below 153.0.8010.36
Monitor for anomalous renderer-to-broker IPC patterns that correlate with cast session initialization
Correlate browser crash telemetry with subsequent process creation events to surface post-exploitation activity

Monitoring Recommendations

Ingest browser process telemetry (process creation, module load, network) into your SIEM for behavioral analytics
Track Chrome auto-update deployment status through endpoint management tooling
Alert on Chrome renderer processes creating executable files in user-writable directories

How to Mitigate CVE-2026-87588

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints
Force browser restart after the update to apply the patched binaries
Audit third-party Chromium-based browsers for downstream patches addressing the same defect

Patch Information

Google released the fix in the Chrome Stable channel update announced on the Chrome Releases blog. Deploy the patched build 153.0.8010.36 via enterprise management channels or allow Chrome's built-in updater to complete.

Workarounds

Disable the Chromecast and Media Router features via enterprise policy where casting is not a business requirement
Restrict browsing to trusted sites via URL allow-lists until patches are deployed
Enforce site isolation and strict sandboxing policies through Chrome Enterprise settings

bash

# Chrome Enterprise policy example (Windows registry) to disable Media Router
reg add "HKLM\Software\Policies\Google\Chrome" /v EnableMediaRouter /t REG_DWORD /d 0 /f

# Verify installed Chrome version
"C:\Program Files\Google\Chrome\Application\chrome.exe" --version