CVE-2026-87489 in Chrome
Summary
by MITRE • 09/09/2026
Memory corruption in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted Chrome extension. (Chromium security severity: Low)
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified involves a memory corruption flaw within the V8 JavaScript engine, which serves as the core runtime for Google Chrome and other Chromium-based browsers. This specific issue arises from improper handling of memory operations during the execution of scripts contained within crafted Chrome extensions. The severity is classified as low by the Chromium security team, indicating that while the bug exists in the codebase, exploiting it to achieve arbitrary code execution requires significant effort or favorable conditions that are not trivially achievable for a typical attacker. However, the potential impact remains critical because successful exploitation could allow an adversary to bypass browser sandboxing mechanisms and execute malicious commands with the privileges of the current user.
From a technical perspective, memory corruption vulnerabilities in V8 often stem from issues such as use-after-free errors, buffer overflows, or type confusion bugs where the engine misinterprets data types during garbage collection or JIT compilation processes. In this instance, the flaw is triggered specifically through the installation or execution of a maliciously constructed Chrome extension. Extensions operate with elevated privileges compared to standard web pages and have access to various browser APIs that can interact deeply with the underlying system. If an attacker can craft an extension that exploits the memory corruption in V8 during its initialization or runtime, they may gain control over program flow by manipulating pointers or heap structures. This manipulation allows for the execution of arbitrary code within the context of the browser process, effectively breaking out of the restricted environment intended to isolate web content from the host operating system.
The operational impact of this vulnerability is primarily tied to social engineering and distribution vectors involving malicious extensions. Since the exploit requires a crafted Chrome extension, an attacker must convince a user to install it or distribute it through unofficial channels such as third-party app stores or direct file sharing. Once installed, if the victim visits a page that triggers the vulnerable code path within the extension's background scripts or content scripts, the memory corruption can be triggered remotely without further interaction from the user. This could lead to data theft, installation of additional malware, or use of the compromised machine as part of a botnet. The low severity rating suggests that reliable exploitation chains are difficult to construct, possibly due to mitigations like ASLR (Address Space Layout Randomization), DEP/NX (Data Execution Prevention), and Chrome’s multi-process architecture which limits the blast radius of such exploits.
To mitigate this risk, users must ensure their browser is updated to version 153.0.8010.36 or later, where these memory management issues in V8 have been patched. It is also advisable to exercise caution when installing extensions from sources other than the official Chrome Web Store, as unofficial repositories may host malicious code designed to exploit such vulnerabilities. Security administrators should enforce policies that restrict extension installation privileges for end-users and regularly audit installed extensions for suspicious behavior or excessive permissions. Additionally, keeping operating system-level protections enabled ensures an additional layer of defense against any successful exploitation attempts.
This vulnerability aligns with CWE-120 Buffer Copy without Checking Size of Input and potentially CWE-416 Use After Free, depending on the specific nature of the memory corruption within V8. In terms of attack tactics, it relates to ATT&CK technique T1505.003 Web Shell: Browser Extension, as attackers may leverage compromised or malicious extensions to maintain persistence or execute commands. The exploitation path also touches upon T1204.002 Malicious File, where the crafted extension serves as the initial delivery mechanism for the exploit code targeting the V8 engine.