CVE-2026-87636: Google Chrome Type Confusion RCE Vulnerability

CVE-2026-87636 Overview

CVE-2026-87636 is a type confusion vulnerability in the XML component of Google Chrome. The flaw affects Chrome versions prior to 153.0.8010.36 and enables remote attackers to execute arbitrary code inside the browser sandbox. Exploitation requires a target to load a crafted HTML page, satisfying the user interaction requirement. Google's Chromium team rated the underlying issue as Medium severity, while NVD assigned a higher CVSS base score reflecting the code execution impact. The vulnerability is tracked under [CWE-843: Access of Resource Using Incompatible Type (Type Confusion)].

Critical Impact
A remote attacker can execute arbitrary code inside the Chrome sandbox by luring a user to a malicious HTML page, providing a foothold for further sandbox escape chains.

Affected Products

Google Chrome versions prior to 153.0.8010.36 (Stable channel, Desktop)
Chromium-based browsers incorporating the vulnerable XML component
Downstream distributions that had not merged the upstream fix at time of publication

Discovery Timeline

2026-09-09 - CVE-2026-87636 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87636

Vulnerability Analysis

The vulnerability resides in Chrome's XML handling code. Type confusion occurs when code accesses a memory region assuming one object type while the underlying data is actually a different type. In Chrome's rendering pipeline, this mismatch allows an attacker to reinterpret object fields, corrupt internal pointers, and hijack control flow. The vendor advisory confirms that successful exploitation yields arbitrary code execution within the renderer sandbox. While the sandbox constrains the immediate blast radius, renderer-level code execution is the standard first stage of modern Chrome exploit chains. Attackers typically pair such primitives with a separate sandbox escape to achieve full compromise of the host.

Root Cause

The root cause is improper type validation in the XML parsing or DOM handling code within Blink or the underlying XML library. See the Chromium Issue Tracker entry #495541478 for the restricted technical detail. Type confusion bugs in browser engines commonly stem from incorrect assumptions about object identity after script-driven mutations, callbacks, or garbage collection interactions during XML tree operations.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker hosts a crafted HTML page that triggers the vulnerable XML code path. When a victim visits the page in an unpatched Chrome build, the malicious document manipulates object types to corrupt memory. No authentication or prior access to the target system is required. Delivery vectors include phishing links, malvertising, watering-hole compromises, and injected content on trusted sites.

No verified public proof-of-concept code is currently available. The Chromium Issue Tracker entry remains access-controlled pending broader patch adoption.

Detection Methods for CVE-2026-87636

Indicators of Compromise

Chrome renderer processes crashing with access violation or type mismatch signatures while parsing XML content
Unexpected child processes spawned from chrome.exe renderer processes shortly after visiting an untrusted page
Outbound connections from renderer processes to unfamiliar domains hosting HTML with embedded XML payloads
Browser telemetry showing installed Chrome build older than 153.0.8010.36 following the vendor patch release

Detection Strategies

Inventory Chrome installations across the fleet and flag any version below 153.0.8010.36 for immediate remediation
Monitor endpoint telemetry for renderer process crashes correlated with XML content delivery over HTTP or HTTPS
Deploy web proxy inspection rules that flag anomalous XML payloads embedded in HTML pages from low-reputation domains
Correlate browser crash reports with subsequent process creation events to identify potential exploitation attempts

Monitoring Recommendations

Enable Chrome enterprise reporting to centralize crash and version telemetry
Alert on execution of unsigned binaries or scripts by child processes of Chrome renderer instances
Track DNS and URL categories for indicators tied to Chrome zero-day exploitation campaigns
Review EDR process trees for anomalous behavior originating from browser processes on high-value user endpoints

How to Mitigate CVE-2026-87636

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all Windows, macOS, and Linux endpoints
Restart the browser after update to ensure the patched binary is loaded into memory
Push the update through enterprise management tooling to eliminate reliance on user-initiated restarts
Prioritize high-risk users such as executives, developers, and administrators who browse externally

Patch Information

Google released the fix in the Stable channel update announced in the Google Chrome Stable Update advisory. The fixed version is 153.0.8010.36. Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi should be updated once vendors ship builds incorporating the upstream fix.

Workarounds

No official workaround exists; patching is the only supported remediation
Restrict browsing to trusted sites via web filtering while patch deployment is in progress
Enable Chrome Site Isolation and Enhanced Safe Browsing to raise the cost of exploitation
Consider temporary use of alternative browsers on unpatched endpoints handling sensitive workflows

bash

# Verify Chrome version on Linux endpoints
google-chrome --version

# Force update on managed macOS endpoints via Jamf or MDM
sudo /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent -runMode oneshot

# Windows: enforce minimum version policy via Group Policy registry key
reg add "HKLM\Software\Policies\Google\Chrome" /v TargetVersionPrefix /t REG_SZ /d "153.0.8010.36" /f