CVE-2026-87558 in Chrome
Summary
by MITRE • 09/09/2026
Use after free in Payments in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability described constitutes a critical use-after-free flaw within the payment handling subsystem of Google Chrome on macOS, specifically affecting versions prior to 153.0.8010.36. This memory corruption issue arises when the browser fails to properly manage the lifecycle of objects associated with payment processing operations. In typical web browsing scenarios involving digital transactions or integrations with third-party payment providers, the application allocates specific data structures in memory to handle sensitive transaction details and state management. When these processes complete or are interrupted, the system is expected to release this allocated memory back to the heap for reuse by other components. However, due to a logic error in the reference counting or pointer invalidation mechanism, certain pointers continue to reference the freed memory block even after it has been deallocated. This creates a dangling pointer scenario where subsequent operations attempt to read from or write to an address that no longer holds valid data under normal circumstances.
The operational impact of this vulnerability is severe because it allows for arbitrary code execution outside the browser's sandbox environment. Modern browsers rely heavily on process isolation and sandboxes to contain potential exploits within limited privilege contexts, thereby preventing attackers from accessing sensitive user files or system resources. By exploiting a use-after-free condition in a high-privilege context such as payment processing, an attacker can manipulate memory layout to achieve control over program execution flow. Through techniques such as heap spraying or precise allocation of subsequent objects into the freed space, the attacker can overwrite function pointers or virtual table entries. This enables the injection and execution of malicious shellcode with elevated privileges, effectively breaking out of the restrictive sandbox boundaries that protect the user's system integrity.
From a classification perspective, this vulnerability aligns closely with CWE-416, which defines use-after-free errors as accessing memory after it has been freed. The exploitation vector is classified under ATT&CK technique T1203, specifically targeting software applications to execute code on remote systems. The severity rating of High by the Chromium security team reflects the ease with which this flaw can be triggered via a crafted HTML page and its potential for full system compromise without user interaction beyond visiting the malicious site. Such vulnerabilities are particularly dangerous in financial contexts where browsers handle sensitive credentials, making them attractive targets for advanced persistent threats and financially motivated cybercriminals seeking to steal banking information or install malware on victim machines.
Mitigation strategies primarily involve immediate software updates to ensure that all instances of Google Chrome on macOS are upgraded to version 153.0.8010.36 or later, where the memory management logic for payment components has been corrected. Developers should implement rigorous static analysis and dynamic fuzzing during the development lifecycle to detect dangling pointer issues before deployment. Additionally, enabling advanced security features such as Heap Safety Mode in Chromium-based browsers can provide additional layers of protection by randomizing heap allocations and detecting invalid accesses more reliably. For end-users, maintaining up-to-date browser versions is the most effective defense against this class of memory corruption vulnerabilities, as patching addresses the root cause within the application code rather than relying solely on external security controls.