CVE-2026-87637: Google Chrome Use After Free Vulnerability

CVE-2026-87637 Overview

CVE-2026-87637 is a use-after-free vulnerability in the Extensions component of Google Chrome on macOS prior to version 153.0.8010.36. A remote attacker can exploit the flaw by serving a crafted HTML page, enabling arbitrary code execution outside the Chrome sandbox. The issue is tracked under [CWE-416] and requires user interaction, such as visiting an attacker-controlled page. Google credits the bug internally through the Chromium Issue Tracker entry #534863145. The flaw carries a sandbox escape impact, which elevates the risk beyond typical renderer-only memory corruption. Exploitation gives attackers execution in the context of the browser process on the host operating system.

Critical Impact
Successful exploitation allows arbitrary code execution outside the Chrome sandbox on macOS, granting attackers foothold on the host from a single crafted web page.

Affected Products

Google Chrome for macOS prior to 153.0.8010.36
Apple macOS (host operating system for the vulnerable Chrome builds)
Chromium-based components using the affected Extensions code path

Discovery Timeline

2026-09-09 - CVE-2026-87637 published to the National Vulnerability Database (NVD)
2026-09-09 - Google publishes the Stable Channel desktop update advisory
2026-09-10 - Last updated in the NVD database

Technical Details for CVE-2026-87637

Vulnerability Analysis

The vulnerability is a use-after-free (UAF) in the Chrome Extensions subsystem. Chrome frees a heap object while another code path retains and later dereferences a stale pointer. An attacker who controls the timing of allocation and deallocation can place attacker-influenced data at the freed location. Dereferencing the reused memory then yields controlled flow or data corruption inside a privileged browser process. Because the affected path resides in the extensions system rather than a sandboxed renderer, successful exploitation escapes the Chrome sandbox on macOS. This gives the attacker native code execution as the browser user without requiring a separate sandbox-escape bug.

Root Cause

The root cause is improper object lifetime management in the Chrome Extensions component, classified as [CWE-416]. A component releases an object while another holds a reference, violating Chromium's ownership contract. Subsequent access to the dangling pointer produces memory corruption that an attacker can shape into arbitrary code execution.

Attack Vector

Exploitation requires a user to load a crafted HTML page in a vulnerable Chrome build on macOS. The page drives extension-related interactions to trigger the free-then-reuse sequence. No credentials are required, and the attack executes across the network with low complexity. Because the scope changes and integrity, confidentiality, and availability impacts are all high, the flaw is treated as a browser-to-host compromise vector.

No public proof-of-concept, exploit code, or CISA KEV listing exists for CVE-2026-87637 at publication. Technical specifics remain restricted; see the Chromium Issue Tracker #534863145 once access is opened.

Detection Methods for CVE-2026-87637

Indicators of Compromise

Chrome browser processes on macOS spawning unexpected child processes such as bash, osascript, curl, or python3.
Chrome crash reports referencing the Extensions subsystem with heap-use-after-free signatures.
Outbound network connections from Google Chrome.app to newly registered or low-reputation domains immediately after page loads.
Creation of persistence artifacts under ~/Library/LaunchAgents/ or ~/Library/Application Support/ originating from a Chrome process ancestry.

Detection Strategies

Inventory installed Chrome versions across macOS endpoints and flag any build below 153.0.8010.36.
Alert on Chrome process trees that execute shell interpreters, scripting engines, or file-write operations outside the browser cache.
Correlate browser crash telemetry with subsequent anomalous network or filesystem activity in the same session.

Monitoring Recommendations

Ingest macOS Endpoint Security Framework (ESF) events for Google Chrome Helper and parent Chrome processes into your SIEM or data lake.
Monitor extension installation and update activity, particularly from sources outside the Chrome Web Store.
Track browser version telemetry continuously to detect drift from patched baselines.

How to Mitigate CVE-2026-87637

Immediate Actions Required

Update Google Chrome on macOS to version 153.0.8010.36 or later on every managed device.
Restart Chrome after the update to ensure the vulnerable process image is unloaded from memory.
Audit installed browser extensions and remove any that are unused, unmaintained, or from untrusted publishers.
Verify update policies and enforce automatic updates through MDM for endpoints not on managed configurations.

Patch Information

Google released the fix in the Chrome Stable channel for desktop. See the Google Chrome Desktop Update advisory for release notes. The fixed macOS build is 153.0.8010.36. Additional context is available in the Chromium Issue Tracker #534863145.

Workarounds

Restrict extension installation using enterprise policy keys such as ExtensionInstallBlocklist and ExtensionInstallAllowlist until patching is complete.
Route web traffic through a secure web gateway that blocks known malicious and newly registered domains.
Advise users to avoid loading untrusted links in vulnerable Chrome builds and to prefer alternative browsers during the remediation window.

bash

# Verify Chrome version on macOS endpoints
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Force Chrome to check for updates via the Google Update helper
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent -runMode oneshot