CVE-2026-87612: Google Chrome V8 Type Confusion RCE Flaw

CVE-2026-87612 Overview

CVE-2026-87612 is a type confusion vulnerability in the V8 JavaScript engine used by Google Chrome versions prior to 153.0.8010.36. A remote attacker can execute arbitrary code inside the Chrome sandbox by luring a user to a crafted HTML page. The flaw is tracked under CWE-843: Access of Resource Using Incompatible Type and was rated High severity by the Chromium security team. Google addressed the issue in the Stable channel desktop update published in September 2026.

Critical Impact
Successful exploitation allows arbitrary code execution within the renderer sandbox after a single visit to a malicious web page.

Affected Products

Google Chrome for Desktop prior to 153.0.8010.36
Chromium-based browsers that embed vulnerable V8 builds
Downstream distributions bundling Chrome before the September 2026 Stable channel update

Discovery Timeline

2026-09-09 - CVE-2026-87612 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87612

Vulnerability Analysis

The vulnerability resides in V8, the JavaScript and WebAssembly engine that powers Chrome. Type confusion occurs when the engine allocates or accesses an object as one type while the underlying memory represents a different type. This mismatch causes V8 to interpret memory contents with incorrect assumptions about layout, size, or field semantics.

An attacker who controls JavaScript execution can leverage this confusion to read or write memory beyond intended boundaries. Chained with typical browser exploitation primitives, the bug provides arbitrary read and write within the renderer process. The impact aligns with a code execution outcome inside the Chrome sandbox, requiring user interaction to load the crafted HTML page.

Root Cause

The root cause is improper type validation in V8, classified as CWE-843. V8 optimizations rely on hidden classes, inline caches, and speculative type assumptions. When an assumption is violated but not correctly invalidated, subsequent operations treat an object of type A as type B, producing exploitable memory corruption. Google has not publicly disclosed the specific V8 component to protect users still deploying the patch.

Attack Vector

Exploitation requires a victim to visit a web page hosting attacker-controlled JavaScript. The attack works over the network without authentication but requires user interaction. Delivery methods include malvertising, watering-hole compromises, phishing links, and cross-site redirects. Because execution is contained inside the renderer sandbox, attackers typically pair this bug with a sandbox escape to achieve full system compromise.

No public proof-of-concept code is available. Technical details are limited pending broader patch adoption. Refer to the Chromium Issue Tracker entry #554236352 once Google unrestricts access.

Detection Methods for CVE-2026-87612

Indicators of Compromise

Chrome renderer processes crashing with SIGSEGV or V8 abort messages referencing type mismatches
Outbound connections from browser processes to unexpected domains shortly after page loads
Creation of child processes or file writes by chrome.exe outside standard profile directories
Endpoint telemetry showing browser processes spawning shells, powershell.exe, or cmd.exe

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build below 153.0.8010.36
Correlate browser crash reports with URLs visited immediately before the crash
Alert on anomalous process lineage where Chrome renderer processes spawn non-browser executables
Monitor for unusual memory allocation patterns or renderer sandbox violations in EDR telemetry

Monitoring Recommendations

Enable Chrome enterprise reporting to centralize version, extension, and crash data
Ingest browser and endpoint telemetry into a SIEM for correlation with threat intelligence on malicious URLs
Track outbound web requests to newly registered domains that host active JavaScript payloads
Review web proxy logs for user access to uncategorized sites during the exposure window

How to Mitigate CVE-2026-87612

Immediate Actions Required

Update Chrome to version 153.0.8010.36 or later on all Windows, macOS, and Linux endpoints
Restart the browser after update to ensure the patched V8 binary is loaded
Push the update through enterprise management tooling such as Chrome Browser Cloud Management or MDM
Audit Chromium-based browsers including Edge, Brave, and Opera for equivalent upstream V8 fixes

Patch Information

Google released the fix in the Stable channel update documented in the Google Chrome Desktop Update advisory. Administrators should validate that clients receive 153.0.8010.36 or a later build. The Chromium tracker reference is Issue #554236352.

Workarounds

Disable JavaScript for untrusted sites using Chrome site settings or enterprise policy DefaultJavaScriptSetting
Restrict browsing to allowlisted domains via web proxy or DNS filtering until patching completes
Deploy site isolation and strict sandboxing policies through Chrome enterprise configuration
Educate users to avoid unknown links and enforce phishing-resistant email filtering

bash

# Verify Chrome version on Linux endpoints
google-chrome --version

# Windows registry policy to enforce automatic updates
reg add "HKLM\SOFTWARE\Policies\Google\Update" /v UpdateDefault /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Google\Update" /v AutoUpdateCheckPeriodMinutes /t REG_DWORD /d 60 /f