CVE-2026-87639: Google Chrome Use After Free Vulnerability

CVE-2026-87639 Overview

CVE-2026-87639 is a use-after-free vulnerability [CWE-416] in the WebPackaging component of Google Chrome. The flaw affects Chrome versions prior to 153.0.8010.36. A remote attacker who has already compromised the renderer process can leverage a crafted HTML page to execute arbitrary code outside the browser sandbox. Google's Chromium security team rated the underlying issue as High severity.

Critical Impact
Successful exploitation enables sandbox escape and arbitrary code execution on the host, breaking Chrome's primary isolation boundary.

Affected Products

Google Chrome for Desktop versions prior to 153.0.8010.36
Chromium-based browsers incorporating the vulnerable WebPackaging component
All operating system builds (Windows, macOS, Linux) sharing the affected Chrome codebase

Discovery Timeline

2026-09-09 - CVE-2026-87639 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87639

Vulnerability Analysis

The vulnerability resides in Chrome's WebPackaging implementation, which handles Web Bundles and Signed HTTP Exchanges. A use-after-free condition occurs when the component references memory that has already been released. An attacker leveraging a compromised renderer process can manipulate object lifetimes to reclaim freed memory with attacker-controlled data.

Because WebPackaging code executes in a browser process with broader privileges than the renderer sandbox, exploitation crosses a trust boundary. The result is arbitrary code execution outside the sandbox on the user's host. This category of flaw is a common building block in multi-stage Chrome exploit chains.

Root Cause

The defect is a classic dangling pointer scenario. WebPackaging retains a reference to an object whose backing memory has been deallocated. Subsequent operations dereference that stale pointer, allowing attackers to influence control flow or corrupt adjacent structures when the memory is reallocated for attacker-controlled content.

Attack Vector

Exploitation requires two conditions. First, the attacker must already have code execution inside the renderer process, typically via a prior renderer bug. Second, the victim must load a crafted HTML page that triggers the vulnerable WebPackaging code path. User interaction is required, and attack complexity is elevated because a working renderer compromise is a prerequisite.

No public proof-of-concept exploit is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The vulnerability mechanism is described in the Chromium Issue Tracker #544415098.

Detection Methods for CVE-2026-87639

Indicators of Compromise

Chrome renderer or browser process crashes referencing WebPackaging, Web Bundle, or Signed Exchange handling code paths
Unexpected child processes spawned by chrome.exe following navigation to untrusted sites
Outbound network connections from Chrome processes to previously unseen infrastructure immediately after loading a crafted page

Detection Strategies

Monitor endpoint telemetry for Chrome browser process anomalies, including unexpected memory-region allocations and non-standard child process creation
Alert on Chrome versions in the environment that remain below 153.0.8010.36 using software inventory or vulnerability management data
Correlate browser crash dumps with subsequent process-injection or persistence activity on the same host

Monitoring Recommendations

Ingest Chrome update state and version telemetry into the SIEM to track patch compliance in real time
Baseline normal Chrome child-process trees and alert on deviations such as shell or scripting-host children
Track DNS and HTTP telemetry for known malicious Web Bundle or Signed Exchange delivery infrastructure

How to Mitigate CVE-2026-87639

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints
Force-restart Chrome after deployment to ensure the patched binaries are loaded into memory
Audit installed Chromium-derived browsers and apply vendor updates that incorporate the upstream fix

Patch Information

Google addressed CVE-2026-87639 in the Chrome Stable channel at version 153.0.8010.36. Refer to the Google Chrome Stable Update advisory for release details and the Chromium Issue Tracker #544415098 for the underlying bug reference.

Workarounds

No vendor-supplied workaround exists; patching is the required remediation
Enforce enterprise browser update policies to guarantee automatic delivery of the fixed version
Restrict navigation to untrusted sites via web proxy or DNS filtering until patch deployment is verified

bash

# Verify Chrome version on Linux endpoints
google-chrome --version

# Windows: query the installed Chrome version from the registry
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv