CVE-2026-87588 in Chrome
Summary
by MITRE • 09/09/2026
Use after free in Chromecast in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as a use-after-free flaw within the Chromecast component of Google Chrome prior to version 153.0.8010.36 represents a critical memory safety issue that undermines the browser's sandboxing mechanisms. This type of error occurs when a program continues to use a pointer after it has been freed, leading to undefined behavior that can be exploited by malicious actors. In this specific instance, the flaw resides in how Chrome manages memory for objects associated with Chromecast functionality, which is used for casting media content from browsers to compatible devices. The security severity of this vulnerability is classified as Medium within the Chromium project's internal scoring system, reflecting its potential impact on user data and system integrity rather than immediate full system compromise without additional exploitation steps.
The operational mechanism involves a remote attacker crafting an HTML page that triggers the premature deallocation of a specific object while references to it are still active in memory. When the browser attempts to access this dangling pointer during normal rendering or interaction processes, it may read from or write to arbitrary memory locations. This condition creates opportunities for heap corruption and can potentially lead to arbitrary code execution within the context of the Chrome sandbox. The attacker delivers the malicious HTML page through standard web delivery methods such as phishing links or compromised websites, relying on social engineering or drive-by download techniques to get the victim's browser to load the content.
From a classification perspective, this vulnerability aligns with CWE-416, which defines use-after-free errors where memory is accessed after it has been freed. The exploitation path leverages ATT&CK technique T1203, specifically the execution of malicious code via web browsers, and may involve T1059 if scripting languages are used to facilitate the exploit chain within the browser environment. The ability to execute arbitrary code inside the sandbox is particularly concerning because it bypasses some of the isolation protections designed to contain damage from compromised processes. While modern browsers employ various mitigations such as ASLR and DEP, successful exploitation can still lead to privilege escalation or further lateral movement if additional vulnerabilities are chained together.
The impact of this vulnerability extends beyond simple data theft. An attacker who successfully exploits this flaw could gain control over the browser process, potentially accessing sensitive information stored locally by Chrome, including cookies, saved passwords, and browsing history. Furthermore, depending on the specific implementation details not fully disclosed in the summary, there may be risks associated with escaping the sandbox entirely to interact with the underlying operating system. This makes timely patching essential for maintaining the security posture of users who rely on Chromecast features within their daily browsing activities.
Mitigation strategies primarily involve updating Google Chrome to version 153.0.8010.36 or later, where these memory management issues have been addressed by developers through rigorous code reviews and automated fuzzing tests. Organizations should enforce automatic update policies for all endpoints running the browser to ensure that security patches are applied promptly upon release. For users unable to upgrade immediately, disabling Chromecast functionality via browser flags can reduce the attack surface, although this may impact legitimate use cases. Additionally, deploying web filtering solutions and endpoint detection and response tools can help identify and block attempts to load malicious HTML pages known to contain exploit code targeting this specific vulnerability class.