CVE-2026-87646: Google Chrome Use After Free Vulnerability

CVE-2026-87646 Overview

CVE-2026-87646 is a use-after-free vulnerability in the Web Authentication component of Google Chrome versions prior to 153.0.8010.36. A remote attacker can execute arbitrary code outside the browser sandbox by convincing a user to visit a crafted HTML page. The flaw is tracked as CWE-416: Use After Free and affects the WebAuthn API implementation used for FIDO2, passkeys, and hardware security key operations. Google has rated the Chromium security severity as High and issued a patch through the Stable channel update. Because Chrome shares its rendering and WebAuthn code with other Chromium-based browsers, downstream projects may also require updates.

Critical Impact
A remote attacker can achieve arbitrary code execution outside the Chrome sandbox through a crafted web page, enabling full compromise of the underlying host with only minimal user interaction.

Affected Products

Google Chrome Desktop versions prior to 153.0.8010.36
Chromium-based browsers embedding the vulnerable WebAuthn component
Chrome-based application frameworks using the affected Web Authentication code path

Discovery Timeline

2026-09-09 - CVE-2026-87646 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87646

Vulnerability Analysis

The vulnerability resides in Chrome's Web Authentication (WebAuthn) subsystem, which brokers credential creation and assertion requests between web content and platform authenticators. A use-after-free condition allows attacker-controlled JavaScript to reference memory that has already been released by the WebAuthn handler. When the freed memory is reallocated with attacker-controlled data, the browser dereferences a corrupted object, redirecting control flow.

Exploitation results in code execution outside the renderer sandbox, meaning the attacker inherits the privileges of the browser process rather than being confined to the restricted renderer. This class of bug is routinely chained by exploit developers because it bypasses the sandbox boundary that normally contains renderer-only flaws.

Root Cause

The root cause is improper lifetime management of an object within the WebAuthn implementation. A reference to the object persists after it has been freed, typically because an asynchronous callback or cross-thread task retains a raw pointer. When the callback later executes, the freed memory is treated as a valid object, satisfying the conditions for a use-after-free described in CWE-416.

Attack Vector

Exploitation requires a victim to load a crafted HTML page in a vulnerable version of Chrome. The page invokes the WebAuthn API in a sequence that triggers the object-lifetime bug, then sprays the heap to place controlled data into the freed allocation. No credentials or prior authentication are required, and the attack works over the network against default browser configurations.

Technical tracking of the fix is available in the Chromium Issue Tracker. Public exploit code has not been observed at the time of publication.

Detection Methods for CVE-2026-87646

Indicators of Compromise

Chrome browser processes spawning unexpected child processes such as cmd.exe, powershell.exe, or shell interpreters immediately after web browsing activity
Outbound connections from chrome.exe to previously unseen domains hosting HTML content that invokes WebAuthn APIs
Chrome crash dumps referencing the WebAuthn or content::AuthenticatorImpl code paths
Unexpected file writes into user profile directories or startup locations by the browser process

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any build earlier than 153.0.8010.36
Monitor for anomalous process trees originating from chrome.exe, particularly parent-child relationships that bypass expected renderer sandboxing
Correlate browser telemetry with EDR events that show memory injection, unusual thread creation, or code execution outside the renderer

Monitoring Recommendations

Enable browser crash reporting and forward telemetry to a central SIEM for review of WebAuthn-related exceptions
Alert on Chrome instances lacking recent updates through endpoint management tooling
Track WebAuthn API usage patterns from untrusted domains in web proxy logs

How to Mitigate CVE-2026-87646

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints without delay
Restart Chrome after the update to ensure the patched binary is active in memory
Audit Chromium-based applications, including Electron shells and embedded browsers, and apply upstream patches when available
Communicate the update requirement to end users and enforce compliance through endpoint management

Patch Information

Google released the fix in the Stable channel update announced in the Google Chrome Update Announcement. The fixed version is 153.0.8010.36. Enterprise administrators should validate that group policies do not pin Chrome to an older major version and should confirm auto-update is enabled.

Workarounds

Restrict browsing to trusted sites through web filtering policies until the update is deployed
Disable the Web Authentication API in high-risk environments using enterprise policy where operational requirements permit
Isolate browsing activity in a hardened virtual machine or remote browser isolation service for privileged users

bash

# Verify installed Chrome version on Windows
reg query "HKLM\SOFTWARE\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Verify installed Chrome version on Linux
google-chrome --version

# Force update on macOS via Google Software Update
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent -runMode oneshot -userInitiated YES