CVE-2026-87634: Google Chrome Use After Free Vulnerability

CVE-2026-87634 Overview

CVE-2026-87634 is a use-after-free vulnerability in the WebPackaging component of Google Chrome. The flaw affects Chrome versions prior to 153.0.8010.36 and allows a remote attacker to potentially execute arbitrary code outside the browser sandbox. Exploitation requires a victim to visit a crafted HTML page, meaning the attack combines network delivery with user interaction. The vulnerability is tracked under CWE-416: Use After Free and Google's Chromium bug tracker as Chromium Issue #349994197.

Critical Impact
Successful exploitation permits arbitrary code execution outside the Chrome sandbox, giving attackers direct access to the underlying operating system through a single malicious web page.

Affected Products

Google Chrome (Desktop) versions prior to 153.0.8010.36
Chromium-based browsers that share the vulnerable WebPackaging component
All supported desktop platforms shipped through the Chrome Stable channel

Discovery Timeline

2026-09-09 - CVE-2026-87634 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87634

Vulnerability Analysis

The vulnerability resides in the WebPackaging subsystem of Chrome. WebPackaging handles the parsing and processing of Signed HTTP Exchanges and Web Bundles, which allow content to be distributed as verifiable packages. A use-after-free occurs when the component references memory that has already been released. An attacker who controls object lifetimes through crafted package structures can reclaim the freed allocation and steer subsequent operations toward attacker-controlled data.

Google categorizes the Chromium severity as Low internally, but the NVD scoring reflects sandbox escape potential. Exploitation delivers code execution outside the renderer sandbox, which removes the primary containment layer between web content and the host operating system.

Root Cause

The root cause is improper lifetime management of an object within WebPackaging. Code paths retain a pointer or reference to a heap object after the allocation has been freed. Subsequent access dereferences that stale pointer, corrupting adjacent heap state or transferring control flow into attacker-controlled memory.

Attack Vector

An attacker hosts a crafted HTML page that references a malicious Web Bundle or Signed HTTP Exchange. When a victim loads the page, WebPackaging processes the payload and triggers the freed object access. Because the flaw enables execution outside the sandbox, no additional escape chain is required to reach host-level code execution. The vulnerability requires user interaction limited to visiting a URL.

No public proof-of-concept or in-the-wild exploitation has been reported. Public exploit details are not available; see Chromium Issue #349994197 for the tracked defect.

Detection Methods for CVE-2026-87634

Indicators of Compromise

Chrome processes spawning unexpected child processes such as cmd.exe, powershell.exe, or /bin/sh immediately after browsing activity
Outbound network connections from Chrome to newly registered or low-reputation domains hosting .wbn Web Bundle files
Unexpected file writes by chrome.exe outside the standard user profile and cache directories

Detection Strategies

Hunt for browser process trees where Chrome parent processes launch shells, scripting engines, or LOLBins that indicate sandbox escape behavior
Inspect HTTP responses with Content-Type: application/webbundle or application/signed-exchange from untrusted origins
Correlate endpoint telemetry with EDR-recorded browser exploitation patterns such as ROP-style memory allocations in renderer or utility processes

Monitoring Recommendations

Enforce Chrome version compliance reporting to identify endpoints running builds earlier than 153.0.8010.36
Log DNS and web proxy events for requests to domains serving Web Bundle content from outside the corporate CDN
Alert on anomalous crashes in Chrome utility processes handling packaged web content, which often precede successful exploitation attempts

How to Mitigate CVE-2026-87634

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all desktop endpoints
Restart Chrome after the update to ensure the patched binary is loaded across all user sessions
Audit managed browser fleets and force policy-driven updates for endpoints that have suppressed automatic updates

Patch Information

Google addressed CVE-2026-87634 in the Chrome Stable channel release documented in the Chrome Releases Desktop Update. Administrators should deploy Chrome 153.0.8010.36 or later. Chromium-based browsers should ship the vendor's corresponding rebased release.

Workarounds

Restrict browsing to trusted origins through web proxy allowlists until patches are deployed
Block downloads and responses with application/webbundle and application/signed-exchange MIME types at the network gateway
Deploy Chrome enterprise policies that disable Web Bundles where the feature is not required for business workflows

bash

# Chrome enterprise policy example to enforce minimum version and restrict content
# Windows registry (HKLM\SOFTWARE\Policies\Google\Chrome)
TargetVersionPrefix = "153.0.8010.36"
URLBlocklist = ["*://*/*.wbn", "*://*/*.sxg"]