CVE-2026-87617: Google Chrome DevTools Use After Free Flaw

CVE-2026-87617 Overview

CVE-2026-87617 is a use-after-free vulnerability in the DevTools component of Google Chrome prior to version 153.0.8010.36. A remote attacker who convinces a user to visit a crafted HTML page can trigger the flaw and execute arbitrary code inside the browser sandbox. Exploitation requires user interaction, typically through social engineering. Google classified the underlying Chromium security severity as Low, though the National Vulnerability Database rates the CVE higher due to potential code execution impact. The issue is tracked as CWE-416: Use After Free and was addressed in the Stable channel update for desktop.

Critical Impact
Remote attackers can achieve arbitrary code execution within the Chrome sandbox by luring users to a malicious HTML page that interacts with DevTools.

Affected Products

Google Chrome versions prior to 153.0.8010.36 (Desktop Stable channel)
Chromium-based browsers that embed the vulnerable DevTools component
All supported desktop platforms (Windows, macOS, Linux) running affected Chrome builds

Discovery Timeline

2026-09-09 - CVE-2026-87617 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87617

Vulnerability Analysis

The flaw resides in Chrome's DevTools subsystem, which provides in-browser debugging and inspection capabilities. A use-after-free condition occurs when the DevTools code continues to reference memory that has already been released. An attacker who controls the timing and layout of freed objects can place attacker-controlled data at that address, then redirect execution when Chrome dereferences the stale pointer. Because DevTools handles complex, JavaScript-driven state, small changes to page structure can influence allocation patterns and make exploitation feasible from a crafted HTML page. Successful exploitation yields code execution constrained to the Chrome sandbox, but pairing this bug with a sandbox escape would extend the attack to the host operating system.

Root Cause

The root cause is improper object lifetime management within a DevTools code path, categorized as CWE-416. A pointer remains in use after the referenced object is freed, allowing memory reuse to corrupt program state.

Attack Vector

Exploitation requires a victim to load an attacker-controlled HTML page and perform an action that engages DevTools, consistent with the social engineering requirement noted in the advisory. No credentials or prior access are required. See the Chromium Issue Tracker entry #523442920 for reference.

No public proof-of-concept code has been released. The vulnerability is described in prose only; refer to the Google Chrome Update Announcement for vendor details.

Detection Methods for CVE-2026-87617

Indicators of Compromise

Chrome renderer processes crashing with heap corruption signatures shortly after visiting an untrusted page
Unexpected child processes spawned from chrome.exe following user interaction with DevTools
Outbound network connections from browser processes to newly registered or low-reputation domains hosting HTML lures

Detection Strategies

Inventory endpoints and flag Chrome installations below version 153.0.8010.36 using software asset management or EDR telemetry
Correlate browser crash telemetry with recent navigation history to identify pages triggering renderer faults
Monitor for anomalous DevTools activation patterns on user endpoints, particularly on machines that do not typically run developer workflows

Monitoring Recommendations

Collect and centralize Chrome crash dumps and process telemetry for retrospective analysis
Alert on execution of unsigned or unexpected binaries whose parent process is the Chrome renderer
Track DNS and HTTP requests from browser processes to domains associated with phishing or malvertising campaigns

How to Mitigate CVE-2026-87617

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints
Restart browsers after update to ensure the patched binary is loaded into memory
Verify Chromium-based third-party browsers have incorporated the corresponding upstream fix

Patch Information

Google addressed CVE-2026-87617 in the Stable channel desktop release documented in the Google Chrome Update Announcement. Administrators should confirm deployment through enterprise policy tools such as Chrome Browser Cloud Management or Group Policy update reporting.

Workarounds

Enforce automatic Chrome updates through enterprise policy to reduce exposure windows
Restrict or disable DevTools access for standard users via the DeveloperToolsAvailability enterprise policy where operationally acceptable
Reinforce user awareness training to reduce the likelihood of engaging with crafted HTML pages delivered through phishing

bash

# Example: enforce DevTools restriction via Chrome enterprise policy (Linux JSON policy)
{
  "DeveloperToolsAvailability": 2
}