CVE-2026-87585 in Chrome
Summary
by MITRE • 09/09/2026
Double free in PDFium in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security severity: High)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as a double free error within the PDFium library, which is integrated into Google Chrome on Windows systems prior to version 153.0.8010.36, represents a critical memory management flaw that can be exploited by remote attackers. This specific type of heap corruption occurs when an application attempts to deallocate a block of memory more than once without properly resetting the pointer or verifying its allocation status in between operations. In the context of PDFium, this likely stems from complex parsing logic handling malformed or specially crafted PDF documents where internal state management fails to track object lifecycles correctly. When such a document is processed, the renderer may invoke deallocation routines on pointers that have already been freed, leading to undefined behavior within the memory allocator. This scenario creates an opportunity for attackers to manipulate heap metadata, potentially achieving arbitrary code execution by overwriting function pointers or other critical data structures with controlled values derived from their crafted input file.
From a technical perspective, this flaw aligns closely with CWE-415, which defines double free as freeing the same pointer more than once, often leading to memory corruption and potential remote code execution. The severity of this vulnerability is classified as High by Chromium security standards due to its impact on system stability and security boundaries. Exploitation typically involves crafting a PDF file that triggers specific parsing paths within PDFium where object references are managed incorrectly during document teardown or incremental updates. By carefully controlling the content and structure of the PDF, an attacker can influence how memory is allocated and freed, creating conditions where the double free condition allows for heap spraying techniques or metadata corruption. This manipulation enables the injection of shellcode into executable regions of memory, facilitating privilege escalation within the browser process context before sandboxing mechanisms can effectively contain the breach.
The operational impact of this vulnerability extends beyond simple application crashes to significant security risks involving unauthorized code execution. Although Chrome employs a multi-process architecture with strict sandboxes designed to limit the damage caused by exploits in renderer processes, sophisticated double free vulnerabilities can sometimes bypass these protections through advanced exploitation techniques such as heap grooming or side-channel attacks that leak memory addresses. If successful, an attacker could execute arbitrary commands on the victim's machine under the context of the browser process, potentially leading to data theft, installation of malware, or further lateral movement within a network environment. The risk is particularly acute for users who frequently open PDF files from untrusted sources via email attachments, web downloads, or embedded links in malicious websites.
Mitigation strategies primarily involve updating Google Chrome and its underlying components to version 153.0.8010.36 or later, where the memory management logic has been patched to prevent double deallocation events. Administrators should ensure that automatic updates are enabled for all endpoints running affected versions of Windows and Chrome to minimize exposure windows. Additionally, users can reduce risk by disabling JavaScript execution in PDF viewers if not required, using browser extensions that restrict file downloads from untrusted domains, or employing dedicated sandboxed environments for viewing sensitive documents. Security teams should also monitor network traffic for unusual outbound connections following document access events, as this may indicate successful exploitation attempts. Regular vulnerability scanning and patch management cycles are essential to maintain defense-in-depth against such memory corruption vulnerabilities in widely used web browsers.