CVE-2026-87578 in Chrome
Summary
by MITRE • 09/09/2026
Use after free in Receiver in Google Chrome prior to 153.0.8010.36 allowed an adjacent attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: High)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as a use-after-free flaw within the receiver component of Google Chrome prior to version 153.0.8010.36 represents a critical memory management error that compromises the integrity and confidentiality of user data. This specific class of vulnerabilities occurs when a program continues to use a pointer after it has been freed, leading to undefined behavior that can be exploited by malicious actors. In this instance, the flaw resides in how Chrome handles network traffic processing within its rendering or networking layers, where memory allocated for receiving data is prematurely deallocated while still being referenced by active processes. This discrepancy creates a window of opportunity for an attacker to manipulate the freed memory region, potentially overwriting it with controlled data that alters program execution flow.
The operational impact of this vulnerability is severe due to its potential for remote code execution outside the browser's sandbox environment. Chrome employs a multi-process architecture designed to isolate web content from the rest of the system through sandboxes, which restrict access to sensitive operating system resources. However, when an adjacent attacker crafts specific network traffic that triggers this use-after-free condition, they can achieve arbitrary code execution with elevated privileges relative to the sandboxed process. This breach allows the malicious payload to escape the restrictive security boundaries established by Chrome, effectively granting the attacker control over the underlying host system or access to sensitive user data stored within the browser context.
From a technical classification perspective, this vulnerability aligns closely with CWE-416, which defines use after free as an error where a pointer is used after it has been freed, often leading to crashes or arbitrary code execution. The exploitation vector involves crafted network traffic, indicating that the attack can be initiated remotely without requiring user interaction beyond visiting a malicious site or receiving a specially constructed packet stream. This aligns with ATT&CK technique T1059, Command and Scripting Interpreter, as the executed code typically serves to establish persistence, escalate privileges, or exfiltrate data following initial access through the browser vulnerability. The Chromium security severity rating of High reflects the significant risk posed by this flaw given its potential for remote exploitation and sandbox escape.
Mitigation strategies primarily involve updating Google Chrome to version 153.0.8010.36 or later, where these memory management issues have been addressed through rigorous code reviews and automated fuzzing tests designed to detect such edge cases in network processing logic. For organizations managing large deployments of browsers, implementing strict update policies ensures that users are protected against known exploits targeting this specific component. Additionally, deploying endpoint detection and response solutions can help identify anomalous processes attempting to escape sandbox boundaries or executing unexpected scripts following browser activity. Network-level controls such as deep packet inspection may also assist in identifying and blocking the crafted traffic patterns associated with exploiting this vulnerability before it reaches end-user systems.