CVE-2026-87628 in Chrome
Summary
by MITRE • 09/09/2026
Use after free in Cast in Google Chrome prior to 153.0.8010.36 allowed an adjacent attacker to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Critical)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as a use-after-free condition within the Cast component of Google Chrome prior to version 153.0.8010.36 represents a critical memory safety flaw that undermines the browser's sandboxing mechanisms. This specific class of error occurs when a program continues to use a pointer after the memory it points to has been freed, often leading to undefined behavior such as crashes or arbitrary code execution. In this instance, the defect resides in the Cast functionality, which handles media casting protocols and related network interactions. The presence of this flaw indicates that during the processing of specific data structures associated with cast sessions, Chrome failed to properly manage memory lifecycles, leaving dangling pointers accessible for subsequent operations.
An adjacent attacker can exploit this vulnerability by crafting malicious network traffic designed to trigger the premature deallocation of critical objects while references to those objects remain active within the application's execution flow. By manipulating the timing and content of these network packets, an adversary can force the browser into a state where it attempts to access or modify memory that has already been returned to the system allocator. This manipulation allows for precise control over heap contents, which is a prerequisite for achieving arbitrary code execution. The ability to execute code outside the sandbox is particularly severe because the Chrome sandbox isolates renderer processes from the operating system kernel and user data; bypassing this isolation grants the attacker full privileges on the affected machine.
From a technical classification perspective, this vulnerability aligns with CWE-416, Use After Free, which describes situations where an application uses memory after it has been freed. The exploitation path leverages ATT&CK technique T1203, Exploitation for Client Execution, as the attacker utilizes crafted network traffic to deliver a payload that executes on the victim's device. Furthermore, because the attack vector involves remote interaction via network protocols without requiring user interaction beyond visiting or interacting with affected web content, it falls under the broader category of remote code execution vulnerabilities. The critical severity rating assigned by Chromium reflects the high likelihood of successful exploitation and the severe impact on system integrity due to sandbox escape capabilities.
The operational impact of this vulnerability is significant for any organization relying on Chrome for secure browsing or internal applications that utilize casting features. Successful exploitation could lead to complete compromise of the user's device, including theft of sensitive data, installation of persistent malware, or use as a pivot point for further attacks within a network environment. Given the widespread adoption of Google Chrome and its integration with various enterprise productivity tools via Cast functionality, this vulnerability poses a substantial risk across both consumer and corporate sectors. Attackers can target specific endpoints by delivering malicious content through compromised websites or phishing campaigns that trigger the vulnerable code paths during normal browsing activities.
Mitigation strategies primarily involve updating to version 153.0.8010.36 or later, where Google has implemented fixes for the memory management logic within the Cast component. Organizations should enforce automated update policies to ensure all endpoints are patched promptly against known critical vulnerabilities. Additionally, security teams can implement network-level controls such as web application firewalls and intrusion detection systems configured to detect patterns associated with heap exploitation attempts or anomalous casting protocol traffic. While these defensive measures provide an additional layer of protection, they do not replace the necessity of applying vendor-provided patches. Regular vulnerability assessments and monitoring for indicators of compromise related to sandbox escape techniques are recommended to maintain a robust security posture against similar memory corruption vulnerabilities in web browsers.