CVE-2026-87601 Overview
CVE-2026-87601 is a race condition vulnerability in the V8 JavaScript engine used by Google Chrome versions prior to 153.0.8010.36. A remote attacker can execute arbitrary code inside the Chrome sandbox by serving a crafted HTML page to a victim. The flaw is tracked under CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization). Chromium's internal security assessment rates the issue Low, but the National Vulnerability Database assigns a higher score reflecting the potential for remote code execution.
Critical Impact
Successful exploitation lets a remote attacker run arbitrary code inside the Chrome renderer sandbox through a crafted web page, providing an initial foothold that can be chained with a sandbox escape.
Affected Products
- Google Chrome versions prior to 153.0.8010.36 (Desktop Stable channel)
- Chromium-based browsers embedding vulnerable V8 builds
- Downstream distributions shipping affected Chrome packages
Discovery Timeline
- 2026-09-09 - CVE-2026-87601 published to the National Vulnerability Database
- 2026-09-10 - CVE record last modified in the NVD database
Technical Details for CVE-2026-87601
Vulnerability Analysis
The vulnerability resides in V8, the JavaScript and WebAssembly engine that powers Chrome. V8 relies on concurrent compilation, garbage collection, and optimization threads that share state with the main execution thread. A race condition in this shared state allows an attacker to trigger inconsistent object or type assumptions during code generation or execution. When the race is won, the engine operates on data that violates its invariants, producing arbitrary code execution within the renderer process. Exploitation requires the victim to load an attacker-controlled HTML page, and reliability depends on precise timing across threads.
Root Cause
The root cause is improper synchronization between concurrent V8 threads accessing shared engine state, classified as CWE-362. Missing or insufficient locking around a critical section permits a Time-of-Check to Time-of-Use (TOCTOU) window that an attacker can influence through JavaScript execution patterns.
Attack Vector
The attack is network-based and requires user interaction. An attacker hosts a malicious HTML page containing crafted JavaScript designed to trigger the race condition inside V8. When the victim navigates to the page in a vulnerable Chrome build, the engine mismanages concurrent access and executes attacker-controlled instructions inside the sandbox. Attack complexity is high because the exploit depends on winning a thread scheduling race. Additional vulnerabilities are typically required to escape the sandbox and reach the host operating system. Refer to the Chromium Issue Tracker #541604100 for engine-specific technical details.
Detection Methods for CVE-2026-87601
Indicators of Compromise
- Chrome renderer processes spawning unexpected child processes such as cmd.exe, powershell.exe, or shell interpreters shortly after web browsing activity.
- Outbound network connections from chrome.exe to previously unseen domains hosting HTML or JavaScript payloads.
- Renderer process crashes or unusual memory allocations correlated with visits to unfamiliar sites.
Detection Strategies
- Inventory installed Chrome versions across the fleet and flag any build below 153.0.8010.36.
- Monitor endpoint telemetry for anomalous behavior originating from Chrome renderer processes, including code injection patterns and process hollowing.
- Correlate web proxy logs with endpoint process creation events to identify suspicious HTML pages preceding renderer anomalies.
Monitoring Recommendations
- Enable browser telemetry forwarding to a centralized log platform for retrospective hunting on visited URLs.
- Track child process lineage from browser processes and alert on non-standard descendants.
- Watch for exploitation attempts against V8 by monitoring for renderer sandbox violations reported in Chrome crash logs.
How to Mitigate CVE-2026-87601
Immediate Actions Required
- Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints.
- Force a browser restart after deployment to ensure the patched V8 build is loaded.
- Audit Chromium-based applications and embedded browser components for the same V8 version dependency.
Patch Information
Google addressed CVE-2026-87601 in the Chrome Stable channel release documented in the Google Chrome Stable Update. Administrators should confirm managed Chrome installations report version 153.0.8010.36 or later. Enterprise environments using Chrome Browser Cloud Management or group policy can accelerate rollout by shortening the update deferral window.
Workarounds
- Restrict browsing to trusted sites through web filtering while patch deployment is in progress.
- Enable Chrome's Site Isolation and strict process-per-site policies to limit renderer compromise scope.
- Disable JavaScript on untrusted origins via enterprise policy where operationally feasible.
# Verify Chrome version on Linux endpoints
google-chrome --version
# Windows: query installed Chrome version via registry
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv
# Enterprise policy to enforce minimum version through auto-update
# (set in Chrome Enterprise policy management)
TargetVersionPrefix = "153.0.8010.36"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
