CVE-2026-87536 in Chrome
Summary
by MITRE • 09/09/2026
Use after free in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as a use-after-free flaw within the V8 JavaScript engine, which powers Google Chrome prior to version 153.0.8010.36, represents a critical memory safety issue that allows for arbitrary code execution under specific conditions. This type of defect occurs when a program continues to use a pointer after the memory it points to has been freed or reallocated. In the context of V8, this typically involves JavaScript objects being garbage collected while still referenced by other parts of the engine's internal state or native bindings. When an attacker crafts a malicious HTML page that triggers this specific sequence of events, they can manipulate the heap layout and overwrite memory contents with controlled data structures. This manipulation effectively bypasses standard safety checks because the runtime believes it is interacting with valid objects rather than corrupted memory regions.
The operational impact of this vulnerability is severe due to its potential for remote code execution via a crafted web page. An attacker does not need physical access or user interaction beyond visiting a malicious URL, making this an effective vector for drive-by download attacks and cross-site scripting exploits that escalate into full system compromise. Because the flaw exists within V8, which operates inside Chrome's sandboxed renderer process, successful exploitation requires additional steps to escape the browser's security boundaries. However, use-after-free vulnerabilities are particularly dangerous because they provide attackers with arbitrary read and write primitives, which can be chained together to bypass Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR). This capability allows the attacker to inject shellcode or hijack control flow to execute malicious binaries on the victim's machine.
From a classification perspective, this vulnerability aligns with CWE-416, which defines use after free as referencing memory that has already been freed. The exploitation technique leverages ATT&CK tactic T1203, specifically falling under subtechniques related to exploit public code or custom tools for application layer protocol abuse and client-side attacks. The high severity rating assigned by the Chromium security team reflects the ease with which such vulnerabilities can be weaponized in modern web environments where complex JavaScript interactions are common. Attackers frequently target these flaws because they offer a reliable path from initial access through to privilege escalation, especially when combined with other browser-specific bypasses or sandbox escape techniques that may exist in older versions of Chrome.
Mitigation strategies primarily involve immediate patching to the latest stable version of Google Chrome, which includes fixes for this specific V8 issue alongside numerous other security hardening measures. Organizations should enforce automatic update policies across all endpoints to ensure users are protected against known vulnerabilities as soon as patches are released. Additionally, deploying browser isolation solutions or web filtering services can reduce exposure by preventing access to untrusted content that might contain exploit code. For developers and security teams, it is crucial to monitor vulnerability databases for related issues in V8 and other components of the Chromium ecosystem, ensuring that third-party extensions and plugins do not introduce similar memory safety flaws through their own integration with browser APIs. Regular audits of web applications using static analysis tools can also help identify potential patterns that might lead to such vulnerabilities during development phases before deployment.