CVE-2026-87625: Google Chrome V8 Use After Free Vulnerability

CVE-2026-87625 Overview

CVE-2026-87625 is a use-after-free vulnerability in the V8 JavaScript engine of Google Chrome. The flaw affects Chrome versions prior to 153.0.8010.36. A remote attacker can leverage social engineering to trick a user into installing a crafted Chrome extension. Successful exploitation allows arbitrary code execution inside the browser sandbox. The vulnerability is tracked under CWE-416 and requires user interaction. Google classified the Chromium security severity as Medium, while the National Vulnerability Database (NVD) rated it High due to the confidentiality, integrity, and availability impact.

Critical Impact
Remote attackers can execute arbitrary code inside the Chrome sandbox by convincing users to install a malicious extension that triggers a use-after-free in V8.

Affected Products

Google Chrome for Desktop versions prior to 153.0.8010.36
Chromium-based browsers embedding vulnerable V8 builds
Chrome Stable channel installations pre-dating the September 2026 update

Discovery Timeline

2026-09-09 - CVE-2026-87625 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87625

Vulnerability Analysis

The vulnerability resides in V8, the JavaScript and WebAssembly engine that powers Chrome. A use-after-free condition occurs when the engine references memory that has already been released. An attacker who controls the freed object's contents can steer code execution paths within the renderer process. Because the exploit path runs through a crafted Chrome extension, the attacker must persuade the victim to install the extension. Once installed, extension scripts interact with V8 in ways that trigger the freed-memory reference. The result is arbitrary code execution constrained to the Chrome sandbox boundary.

Root Cause

The root cause is improper object lifetime management within V8, categorized as [CWE-416] Use After Free. Specific object handles are released while references remain reachable through extension-accessible APIs. When the engine subsequently dereferences the pointer, attacker-controlled data can be treated as a valid object. Public technical details are limited pending broader patch adoption. Refer to Chromium Issue #532921336 for tracking information.

Attack Vector

Exploitation requires network delivery of a malicious extension and user interaction to install it. Once the extension is active, its scripts execute JavaScript that triggers the use-after-free in V8. No prior privileges are required on the target system. The attacker's code executes inside the renderer sandbox, meaning further sandbox escape or privilege chaining is needed to reach the host operating system.

No public proof-of-concept exploit code is available. The vulnerability is described in prose because verified exploitation samples have not been published. See the Google Chrome Stable Update advisory for vendor detail.

Detection Methods for CVE-2026-87625

Indicators of Compromise

Installation of newly published or low-reputation Chrome extensions from outside the Chrome Web Store
Chrome renderer process crashes with signatures pointing to V8 heap corruption
Extension manifests requesting broad host permissions or scripting APIs inconsistent with stated functionality

Detection Strategies

Inventory installed Chrome extensions across managed endpoints and compare against an allow-list
Monitor Chrome version telemetry to identify hosts running versions earlier than 153.0.8010.36
Correlate browser process crashes with recent extension installation events in endpoint telemetry

Monitoring Recommendations

Ingest browser and process telemetry into a centralized data lake for retroactive hunting
Alert on extension side-loading, developer mode activation, and unpacked extension loads
Track outbound connections from chrome.exe renderer children to unfamiliar domains following extension install events

How to Mitigate CVE-2026-87625

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints
Restart Chrome after update to ensure the patched V8 build is loaded into memory
Audit installed extensions and remove any that are unnecessary, unsigned, or side-loaded
Enforce extension installation policies through enterprise management tooling

Patch Information

Google addressed the vulnerability in the Chrome Stable channel release documented in the Google Chrome Stable Update advisory. The fixed version is 153.0.8010.36. Administrators managing Chromium-based browsers should confirm that their vendor has rebased on the patched V8 revision referenced in Chromium Issue #532921336.

Workarounds

Restrict extension installation to a curated allow-list via ExtensionInstallAllowlist and ExtensionInstallBlocklist group policies
Disable developer mode and block side-loading of unpacked extensions on managed devices
Train users to reject unsolicited requests to install browser extensions delivered through phishing or social engineering

bash

# Configuration example: Chrome enterprise policy to restrict extensions (Windows registry)
reg add "HKLM\Software\Policies\Google\Chrome\ExtensionInstallBlocklist" /v 1 /t REG_SZ /d "*" /f
reg add "HKLM\Software\Policies\Google\Chrome\ExtensionInstallAllowlist" /v 1 /t REG_SZ /d "<approved-extension-id>" /f
reg add "HKLM\Software\Policies\Google\Chrome" /v DeveloperToolsAvailability /t REG_DWORD /d 2 /f