CVE-2026-87609: Google Chrome Use After Free Vulnerability

CVE-2026-87609 Overview

CVE-2026-87609 is a use-after-free vulnerability [CWE-416] in the Sharing component of Google Chrome on iOS. The flaw affects Chrome versions prior to 153.0.8010.36. A remote attacker can execute arbitrary code outside the sandbox by delivering crafted network traffic to a targeted browser. Exploitation requires user interaction, such as visiting a malicious page or interacting with attacker-controlled content. Google's Chrome team classified the Chromium severity as Medium, while the NVD assigned a higher CVSS rating reflecting the sandbox escape potential.

Critical Impact
Successful exploitation permits arbitrary code execution outside the Chrome sandbox on iOS, breaking a primary browser isolation boundary.

Affected Products

Google Chrome for iOS versions prior to 153.0.8010.36
Apple iPhone OS running vulnerable Chrome builds
Any iOS deployment where Chrome is installed as an alternative browser

Discovery Timeline

2026-09-09 - CVE-2026-87609 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87609

Vulnerability Analysis

The vulnerability resides in the Sharing subsystem of Chrome on iOS. Sharing handles cross-device content transfer, link forwarding, and related IPC-driven workflows. A use-after-free condition occurs when the component references heap memory that has already been released. An attacker who influences allocation and deallocation timing through crafted network traffic can control the freed object's replacement contents. This primitive enables arbitrary code execution outside the browser sandbox on iOS.

Root Cause

The root cause is improper lifetime management of an object within the Sharing feature. Code paths continue to hold or dereference a pointer after the underlying allocation is freed. When the allocator reuses that memory for attacker-influenced data, subsequent virtual method calls or field accesses operate on adversary-controlled contents. See the Chromium Issue Tracker Entry for upstream details.

Attack Vector

Exploitation is remote and network-borne. An attacker delivers crafted content that Chrome's Sharing component processes, then triggers the use-after-free to hijack control flow. User interaction is required, typically loading a malicious URL or engaging with a share-related workflow. Because the scope changes on successful exploitation, code executes outside Chrome's sandbox with broader access than a standard renderer compromise. Technical exploitation details are not publicly documented; no public proof-of-concept exists.

Detection Methods for CVE-2026-87609

Indicators of Compromise

Chrome for iOS processes crashing or terminating unexpectedly after visiting untrusted content
Outbound connections from mobile devices to unfamiliar domains immediately following browser sessions
Anomalous Sharing-related activity, such as unexpected cross-device link handoffs

Detection Strategies

Inventory Chrome for iOS installations and flag any version below 153.0.8010.36 as vulnerable
Correlate mobile browser crash telemetry with subsequent network beaconing from the same device
Monitor mobile device management (MDM) reports for Chrome versions that fail to update automatically

Monitoring Recommendations

Enforce baseline Chrome version reporting through MDM and alert on drift below the patched release
Ingest mobile web proxy and DNS logs into a central data lake to hunt for post-exploitation callbacks
Track advisories from the Chrome Releases blog for follow-up fixes

How to Mitigate CVE-2026-87609

Immediate Actions Required

Update Chrome for iOS to version 153.0.8010.36 or later on all managed devices
Push the update through MDM to force compliance on corporate iPhones and iPads
Advise users to avoid untrusted links and unsolicited Sharing prompts until patched

Patch Information

Google released the fix in Chrome 153.0.8010.36 for iOS. Refer to the Chrome Releases Update Announcement for the official patch notes and version details. Apple App Store distribution should surface the update automatically for devices with app auto-updates enabled.

Workarounds

Restrict use of Chrome for iOS until the patched version is installed and verified
Route mobile browsing through a filtering proxy to block known malicious domains
Disable or limit cross-device Sharing features where policy allows until updates are confirmed

bash

# Verify Chrome for iOS version compliance via MDM query
# Compliant version: 153.0.8010.36 or later
mdm-cli query --app com.google.chrome.ios --field CFBundleShortVersionString