CVE-2026-87628: Google Chrome Use After Free Vulnerability

CVE-2026-87628 Overview

CVE-2026-87628 is a use-after-free vulnerability [CWE-416] in the Cast component of Google Chrome. The flaw affects Chrome versions prior to 153.0.8010.36. An attacker on an adjacent network can send crafted network traffic to trigger the condition. Successful exploitation may allow arbitrary code execution outside the Chrome sandbox. Google's Chromium project rates the security severity as Critical.

The vulnerability requires no user interaction and no privileges, but the attacker must reside on the same network segment as the target. Because Cast handles media streaming discovery and control, malicious frames can reach the vulnerable code path through standard Cast protocols.

Critical Impact
Sandbox escape via adjacent-network traffic to Chrome's Cast component enables arbitrary code execution on the host system.

Affected Products

Google Chrome Desktop versions prior to 153.0.8010.36
Chromium-based browsers incorporating the same Cast component
Windows, macOS, and Linux Chrome Stable channel builds

Discovery Timeline

2026-09-09 - CVE-2026-87628 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87628

Vulnerability Analysis

The vulnerability resides in Chrome's Cast component, which manages device discovery and media session control for Google Cast-enabled receivers. A use-after-free condition occurs when the component references heap memory that has already been released. An attacker who controls the timing of object destruction can reuse the freed allocation with attacker-chosen data.

Cast protocol handling runs in a privileged browser process context. When the freed object is dereferenced, the corrupted pointer or vtable can redirect execution flow. Because the code path executes outside the renderer sandbox, successful memory corruption yields code execution at the browser process privilege level.

The attack does not require user interaction. Crafted mDNS, SSDP, or DIAL discovery traffic on the local network can reach the vulnerable code without the user initiating a cast session.

Root Cause

The root cause is improper object lifetime management in the Cast subsystem, classified as [CWE-416] Use After Free. Reference counting or ownership tracking fails to keep an object alive while a pending network callback still holds a raw pointer. When the callback fires after object destruction, it operates on invalid memory.

Attack Vector

Exploitation requires network adjacency, meaning the attacker must sit on the same broadcast domain as the victim, such as a shared Wi-Fi network, corporate LAN, or public hotspot. The attacker sends crafted Cast discovery or control messages to the target browser. No user click or navigation is required. Full technical details are tracked in the Chromium Issue Tracker Entry.

Detection Methods for CVE-2026-87628

Indicators of Compromise

Unexpected Chrome browser process crashes with heap corruption signatures in Windows Error Reporting or macOS crash logs
Anomalous outbound connections from chrome.exe following inbound Cast discovery traffic on UDP ports 1900 (SSDP) and 5353 (mDNS)
Child processes spawned by Chrome that do not match legitimate renderer or utility process patterns
Chrome versions below 153.0.8010.36 reported in endpoint inventory data

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag installations below 153.0.8010.36
Monitor for browser process crashes correlated with Cast protocol traffic on the local network
Alert on Chrome processes performing unusual post-exploitation activity such as credential access, persistence writes, or lateral movement attempts

Monitoring Recommendations

Collect endpoint telemetry for Chrome process integrity, module loads, and child process creation
Capture network flow data for mDNS and SSDP traffic on user-facing subnets to identify abnormal Cast discovery volumes
Correlate browser crashes with concurrent network events to surface potential exploitation attempts

How to Mitigate CVE-2026-87628

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all Windows, macOS, and Linux endpoints
Verify automatic update enforcement through group policy or MDM configuration and restart Chrome to apply pending updates
Prioritize patching for users who frequently connect to untrusted or shared networks such as conference Wi-Fi and hotel LANs

Patch Information

Google released the fix in Chrome Stable channel version 153.0.8010.36. Refer to the Google Chrome Desktop Update advisory for the full list of patched issues. Chromium-based browser vendors typically ship corresponding updates within days of the upstream release.

Workarounds

Disable the Media Router and Cast features through the MediaRouterCastAllowAllIPs and EnableMediaRouter enterprise policies until patching is complete
Restrict endpoint access to trusted networks and avoid untrusted Wi-Fi where Cast discovery traffic cannot be filtered
Segment guest and corporate networks to prevent adjacent-network attackers from reaching managed browsers

bash

# Windows registry example to disable the Media Router via enterprise policy
reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v EnableMediaRouter /t REG_DWORD /d 0 /f