CVE-2026-87607: Google Chrome Use After Free Vulnerability

CVE-2026-87607 Overview

CVE-2026-87607 is a use-after-free vulnerability in the Device component of Google Chrome on macOS. The flaw affects Chrome versions prior to 153.0.8010.36. A remote attacker can trigger the condition by convincing a user to visit a crafted HTML page. Successful exploitation allows arbitrary code execution outside the Chrome sandbox. Chromium's internal severity rating for the issue is High, and the vulnerability is tracked under CWE-416.

Critical Impact
Attackers can escape the Chrome sandbox and execute arbitrary code on macOS hosts through a single malicious webpage visit.

Affected Products

Google Chrome on macOS prior to 153.0.8010.36
Apple macOS systems running vulnerable Chrome builds
Chromium-based downstream browsers sharing the affected Device component

Discovery Timeline

2026-09-09 - CVE-2026-87607 published to NVD
2026-09-10 - Last updated in NVD database
2026-09 - Google releases fixed Chrome Stable build 153.0.8010.36 via the Chrome Releases blog

Technical Details for CVE-2026-87607

Vulnerability Analysis

The issue is a use-after-free condition inside the Device subsystem of Chrome on macOS. Use-after-free bugs occur when code continues to reference memory that has already been released back to the allocator. When an attacker controls object lifetimes and allocation ordering, the freed memory can be reclaimed with attacker-chosen data. Subsequent dereference through the stale pointer leads to control-flow hijack or type confusion.

In this case, the Device component handles hardware and platform integration on macOS. Exploitation from a renderer context, combined with the sandbox escape noted in the advisory, indicates the flaw is reachable through IPC or exposed Web APIs that route into the Device broker. That path grants code execution outside the renderer sandbox, which is the more privileged browser process boundary.

Root Cause

The root cause is improper object lifetime management within the Device component. A referenced object is destroyed while other code paths retain a pointer to it. The retained pointer is then used to invoke methods or read state, dereferencing freed memory. Details are tracked in Chromium Issue #553122131.

Attack Vector

Exploitation requires a user to load a crafted HTML page in a vulnerable Chrome build. The attacker delivers JavaScript that manipulates the Device component into freeing an object while a dangling reference remains, then sprays the freed slot with attacker-controlled data. Because the vulnerability crosses the sandbox boundary, a successful exploit yields code execution in the higher-privileged browser process on macOS.

No public proof-of-concept or exploit code is available at time of writing, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical mechanics are described in the linked Chromium issue tracker; no synthetic exploitation code is reproduced here.

Detection Methods for CVE-2026-87607

Indicators of Compromise

Chrome renderer or browser process crashes on macOS endpoints with signatures pointing to the Device component
Unexpected child processes spawned by Google Chrome.app or its helper processes following web browsing activity
Outbound network connections from Chrome helper processes to previously unseen domains hosting HTML payloads
Chrome versions prior to 153.0.8010.36 reported by inventory or MDM tooling

Detection Strategies

Inventory installed Chrome builds across macOS fleets and flag hosts below 153.0.8010.36
Monitor for anomalous process lineage from Chrome helper processes, especially execution of shells, osascript, or curl
Correlate browser crash telemetry with subsequent process creation or persistence activity on the same host
Alert on Chrome writing to non-standard filesystem locations under ~/Library outside normal profile paths

Monitoring Recommendations

Ingest EDR process telemetry from macOS endpoints into a centralized data lake for cross-host correlation
Track Chrome update compliance as a continuously measured control rather than a one-time scan
Baseline normal Chrome child-process behavior to make sandbox escape attempts visible as deviations

How to Mitigate CVE-2026-87607

Immediate Actions Required

Update Google Chrome on all macOS endpoints to version 153.0.8010.36 or later
Force-restart Chrome after the update so the new binary is loaded into memory
Verify update deployment via MDM or endpoint management tooling and remediate lagging hosts
Restrict browsing to trusted sites on any host that cannot be patched immediately

Patch Information

Google addressed CVE-2026-87607 in the Chrome Stable channel release for desktop. macOS users must install Chrome 153.0.8010.36 or newer. Release details are published in the Chrome Stable Channel Update announcement. Chromium-derived browsers should pull the corresponding upstream fix from Chromium Issue #553122131.

Workarounds

Deploy web content filtering to block untrusted or newly registered domains at the network edge
Enforce Chrome auto-update via enterprise policy to minimize the exposure window for future browser CVEs
Consider temporary use of an alternate patched browser for high-risk users until Chrome is updated

bash

# Verify Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Trigger Chrome update check via enterprise management (Jamf example)
sudo jamf policy -event update-chrome