CVE-2026-87587 in Chrome
Summary
by MITRE • 09/09/2026
Use after free in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as a use-after-free flaw within the V8 JavaScript engine, which powers Google Chrome prior to version 153.0.8010.36, represents a critical memory safety issue that allows for arbitrary code execution under specific conditions. This type of error occurs when a program continues to use a pointer after the memory it points to has been freed or reallocated. In the context of V8, this typically involves JavaScript objects being garbage collected while still referenced by native C++ components or other active parts of the engine's runtime environment. When an attacker crafts a malicious HTML page that triggers this specific sequence of events, they can manipulate the memory state such that the freed memory is repurposed for their own data structures rather than being returned to the system allocator. This manipulation allows the attacker to control what values are read from or written to that memory location, effectively gaining a degree of arbitrary write and read primitives within the browser process.
The operational impact of this vulnerability is severe due to its potential for remote code execution via a crafted web page. An attacker does not need physical access or user interaction beyond visiting a malicious website hosted on a server under their control. By embedding exploit code in HTML, CSS, and JavaScript that targets the specific memory management logic within V8, the attacker can achieve arbitrary code execution inside the browser's sandboxed environment. While modern browsers employ multiple layers of defense such as address space layout randomization (ASLR), data execution prevention (DEP), and strict sandboxing to limit the impact of a successful exploit, breaking out of these sandboxes remains a primary goal for attackers seeking full system compromise. The high severity rating assigned by Chromium security reflects the likelihood that this flaw can be chained with other vulnerabilities or leveraged directly to bypass existing mitigations, leading to unauthorized access to sensitive user data, installation of malware, or further lateral movement within a network if the compromised machine is part of an enterprise environment.
From a classification perspective, this vulnerability aligns closely with CWE-416, which describes Use After Free errors. These are among the most dangerous classes of memory corruption bugs because they provide attackers with significant control over program flow and data integrity. The exploitation technique often involves techniques documented in the MITRE ATT&CK framework, particularly those related to initial access through browser exploits and subsequent privilege escalation or defense evasion if sandbox escape is achieved. Attackers may utilize heap spraying techniques to increase the probability that their malicious payload lands in the freed memory region, ensuring predictable behavior during execution. The presence of such a flaw indicates gaps in the garbage collection mechanisms or reference counting logic within V8's internal structures, highlighting the complexity and fragility inherent in high-performance JavaScript engines that must balance speed with safety.
Mitigation for this vulnerability primarily relies on timely software updates to ensure all users are running Google Chrome version 153.0.8010.36 or later, where the underlying memory management issues have been patched by developers at Chromium and V8 projects. Organizations should enforce automated update policies across all endpoints to minimize exposure windows. Additionally, security teams can implement browser hardening strategies such as disabling JavaScript execution for untrusted sites using enterprise policy configurations or deploying advanced threat protection solutions that analyze web content before it reaches the client machine. Monitoring network traffic for connections to known malicious domains hosting exploit kits can also provide an additional layer of defense against attempts to leverage this specific vulnerability in the wild, although technical patching remains the most effective remediation strategy given the remote and automated nature of the attack vector.