CVE-2026-87633: Google Chrome Use After Free Vulnerability

CVE-2026-87633 Overview

CVE-2026-87633 is a use-after-free vulnerability in the Views component of Google Chrome prior to version 153.0.8010.36. The flaw allows a local attacker to execute arbitrary code outside the Chrome sandbox through crafted UI interaction. Chromium's security team rated the underlying issue as High severity. The vulnerability is tracked under CWE-416: Use After Free and affects the Views UI framework used across Chrome desktop platforms.

Critical Impact
Successful exploitation enables sandbox escape and arbitrary code execution in the context of the browser user, undermining Chrome's primary security boundary.

Affected Products

Google Chrome desktop versions prior to 153.0.8010.36
Chromium-based browsers embedding the vulnerable Views component
All supported desktop platforms (Windows, macOS, Linux) running affected Chrome builds

Discovery Timeline

2026-09-09 - CVE-2026-87633 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87633

Vulnerability Analysis

The vulnerability resides in Chrome's Views framework, the C++ UI toolkit responsible for rendering browser chrome elements such as menus, dialogs, and tab strips. A use-after-free condition occurs when a Views object is destroyed while another code path retains a raw pointer to it. Subsequent UI interaction dereferences the dangling pointer, allowing an attacker who controls the freed memory region to hijack execution flow.

Because Views runs in the privileged browser process rather than a sandboxed renderer, exploitation bypasses the Chromium sandbox entirely. Successful memory corruption yields code execution with the full privileges of the browser process.

Root Cause

The root cause is improper lifetime management of a Views object [CWE-416]. Reference tracking between UI event handlers and the underlying view fails to prevent access after object destruction. Full technical details are restricted to the private Chromium Issue #516996291 tracker pending broad patch adoption.

Attack Vector

Exploitation requires local access to the target system and user interaction with a crafted UI element. An attacker with a foothold on the machine can trigger the vulnerable code path through scripted or manual UI events. The scope is marked as changed because compromise of the browser process breaks out of the sandbox boundary, impacting resources beyond the initially vulnerable component.

No public proof-of-concept or in-the-wild exploitation has been reported for CVE-2026-87633. See the Google Chrome Stable Update advisory for vendor guidance.

Detection Methods for CVE-2026-87633

Indicators of Compromise

Chrome browser processes crashing with access violation or segmentation fault signatures referencing Views symbols
Unexpected child processes spawned by chrome.exe following UI interaction events
Chrome installations reporting versions below 153.0.8010.36 in enterprise inventory scans

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build prior to 153.0.8010.36
Monitor for anomalous process creation chains originating from the Chrome browser process, particularly shells or LOLBins
Correlate browser crash telemetry with subsequent suspicious file writes or persistence attempts in user profile directories

Monitoring Recommendations

Enable enterprise crash reporting for Chrome and review dumps referencing the Views subsystem
Ingest endpoint process telemetry into a centralized data lake for behavioral analytics on browser child processes
Track Chrome update compliance through management tooling and alert on stalled deployments

How to Mitigate CVE-2026-87633

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all desktop endpoints
Force restart of the browser after update to ensure the patched binary is loaded
Audit Chromium-based browsers and embedded WebView components for equivalent patched builds

Patch Information

Google addressed CVE-2026-87633 in the Chrome Stable channel release documented in the Stable Channel Update for Desktop. Administrators should deploy Chrome 153.0.8010.36 or later through their standard patch management pipeline. Verify deployment status by checking chrome://version on managed endpoints.

Workarounds

No vendor-supplied workaround exists; patching is the only complete remediation
Restrict interactive local access on shared or high-value workstations to reduce exposure until patches are deployed
Apply least-privilege principles so that browser process compromise yields limited follow-on impact

bash

# Configuration example: verify Chrome version on Linux endpoints
google-chrome --version
# Expected output: Google Chrome 153.0.8010.36 or later