CVE-2026-87474 in Chrome
Summary
by MITRE • 09/09/2026
Use after free in Payments in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as a use-after-free condition within the Payments component of Google Chrome prior to version 153.0.8010.36 represents a critical memory management error that compromises the integrity and confidentiality of user data while potentially allowing for remote code execution. This specific flaw arises when the browser's internal handling of payment-related objects fails to properly manage the lifecycle of allocated memory structures. In typical operation, these objects are created to process transaction details or validate credentials, but due to a logic error in reference counting or pointer invalidation, the application continues to access and dereference pointers to memory that has already been freed by the garbage collector or explicit deallocation routines. This discrepancy creates a window of opportunity where stale pointers remain valid within certain execution contexts until they are overwritten with new data, leading to unpredictable behavior during runtime operations involving payment forms or APIs.
From a technical perspective, this vulnerability aligns closely with CWE-416, which defines use-after-free as the act of using memory after it has been freed. The exploitation vector involves an attacker crafting a malicious HTML page that triggers specific JavaScript interactions within the Chrome Payments subsystem. When a victim visits this crafted page, the embedded script can manipulate the state of payment objects to force the browser into a condition where it attempts to read or write to previously released heap memory. Because modern browsers employ sandboxing techniques to limit the impact of such exploits, the attacker must carefully craft the payload to bypass these isolation boundaries. The high severity rating assigned by Chromium indicates that the flaw is reliably exploitable and allows for significant control over the execution flow within the browser process, potentially leading to arbitrary code execution outside the restricted sandbox environment where normal web content operates.
The operational impact of this vulnerability extends beyond simple data leakage or denial of service. Successful exploitation enables a remote attacker to execute arbitrary commands on the victim's system with the privileges of the current user. This capability allows for the installation of malware, exfiltration of sensitive financial information stored in browser cookies and local storage, and further lateral movement within a network if the compromised machine serves as an entry point. The presence of this flaw undermines the trust model that web browsers rely upon to safely render untrusted content from the internet. Users who engage in online banking or e-commerce transactions are particularly at risk, as their interaction with payment interfaces may inadvertently trigger the vulnerable code paths without any visible indication of compromise until malicious activity occurs on the host system.
Mitigation strategies primarily focus on immediate software updates and defensive configuration practices. The most effective remediation is to upgrade Google Chrome to version 153.0.8010.36 or later, where the memory management logic for payment objects has been corrected to ensure proper pointer invalidation and reference counting. Until an update can be applied, users should exercise caution when visiting unfamiliar websites, particularly those that require input of financial details. Enabling sandboxing features such as site isolation helps restrict the blast radius if a vulnerability is triggered by limiting what resources different sites can access. Additionally, keeping operating system-level security controls like address space layout randomization and data execution prevention enabled provides an additional layer of defense against exploitation attempts derived from memory corruption vulnerabilities.
This incident highlights the ongoing challenges in maintaining secure web browser architectures as they incorporate increasingly complex features for handling sensitive transactions. The integration of payment APIs requires rigorous testing to ensure that all code paths correctly manage dynamic memory allocation and deallocation. Security researchers and developers must continue to prioritize static analysis tools and fuzzing techniques to detect such logic errors before they reach production releases. Awareness of the ATT&CK framework, specifically tactics related to initial access and execution via browser exploitation, reinforces the need for continuous monitoring and rapid patch deployment cycles in enterprise environments to minimize exposure windows against known vulnerabilities like this use-after-free flaw.