CVE-2026-87657: Google Chrome V8 Use After Free Vulnerability

CVE-2026-87657 Overview

CVE-2026-87657 is a use-after-free vulnerability in the V8 JavaScript engine used by Google Chrome. The flaw affects Chrome versions prior to 153.0.8010.36. A remote attacker who has already compromised the renderer process can leverage a crafted HTML page to read memory inside the Chrome sandbox. The issue is tracked under CWE-416 and Chromium rates its internal severity as Medium.

Critical Impact
An attacker with an existing renderer-process compromise can read sandbox memory, enabling information disclosure that can support further exploitation chains.

Affected Products

Google Chrome versions prior to 153.0.8010.36
Chromium-based browsers embedding vulnerable V8 builds
Desktop platforms served by the Chrome Stable channel

Discovery Timeline

2026-09-09 - CVE-2026-87657 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87657

Vulnerability Analysis

The vulnerability resides in V8, the JavaScript and WebAssembly engine bundled with Chrome. A use-after-free condition arises when V8 continues to reference an object after the underlying memory has been released. An attacker that already controls the renderer process can trigger the dangling reference through a crafted HTML page. Successful exploitation permits reading memory that resides inside the renderer sandbox.

The impact is confined to confidentiality within the sandbox boundary. The CVSS vector reflects no impact to integrity or availability, and user interaction is required to load the malicious page. Exploitation is chained: the attacker must first achieve renderer compromise through a separate primitive before reaching this bug.

Root Cause

The root cause is a lifetime-management error in V8. Code paths retain a pointer or handle to a V8 object whose backing store has been freed. Subsequent operations dereference that stale reference and expose adjacent heap contents to attacker-controlled JavaScript. This class of defect is characteristic of CWE-416 in high-performance managed runtimes that mix garbage collection with raw pointers.

Attack Vector

Exploitation requires a two-stage chain. First, the attacker must compromise the renderer process, typically through a separate memory-safety vulnerability. Second, the attacker delivers a crafted HTML page that steers V8 through the vulnerable object lifecycle. The freed object is then reused to leak memory contents. Details of the specific V8 code path are restricted; see the Chromium issue tracker entry and the Google Chrome Stable Channel Update for vendor references.

No public proof-of-concept, exploit code, or CISA KEV listing is associated with this CVE at publication. The EPSS score is 0.173%.

Detection Methods for CVE-2026-87657

Indicators of Compromise

Chrome renderer processes with unexpected crashes referencing V8 heap objects or v8::internal stack frames
Outbound connections from browser processes to previously unseen domains hosting suspicious HTML or JavaScript payloads
Browser telemetry showing Chrome instances running versions below 153.0.8010.36

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag builds earlier than 153.0.8010.36
Monitor for anomalous child-process creation, unusual memory access patterns, or sandbox-related error events emitted by chrome.exe and related binaries
Correlate renderer crash dumps with browsing history to identify pages that consistently trigger V8 faults

Monitoring Recommendations

Ingest browser process telemetry and crash reports into a centralized analytics pipeline for baseline comparison
Alert on Chrome instances that fail to update within organizational patch windows
Track threat-intelligence feeds for reports referencing V8 use-after-free exploitation activity

How to Mitigate CVE-2026-87657

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all endpoints
Restart Chrome after the update to ensure the patched V8 binary is loaded into memory
Verify update rollout status through enterprise management tooling and remediate lagging endpoints

Patch Information

Google released the fix in the Chrome Stable channel as documented in the Chrome Stable Channel Update. Administrators should confirm that clients report a version of 153.0.8010.36 or higher. Additional context is available in the Chromium issue tracker entry, though access may be restricted while embargo policies apply.

Workarounds

Enforce Site Isolation and keep the Chrome sandbox enabled to constrain renderer-process access
Restrict browsing to trusted sites via enterprise policy where feasible until patches are deployed
Disable or limit JavaScript execution on high-risk endpoints where operational requirements permit

bash

# Configuration example: enforce minimum Chrome version via enterprise policy
# Windows registry (HKLM) - block launch of outdated Chrome builds
reg add "HKLM\Software\Policies\Google\Chrome" /v MinimumChromeVersion /t REG_SZ /d "153.0.8010.36" /f

# macOS - configure via managed preferences
defaults write com.google.Chrome MinimumChromeVersion -string "153.0.8010.36"