CVE-2026-87637 in Chrome
Summary
by MITRE • 09/09/2026
Use after free in Extensions in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as a use-after-free condition within Google Chrome's Extensions subsystem on macOS represents a significant memory safety flaw that undermines the browser's core isolation mechanisms. This defect occurs when an extension interacts with internal Chromium objects in a manner where references to those objects are retained after their underlying memory has been deallocated or freed by the system. In modern web browsers, extensions operate within specific security boundaries designed to limit their access to sensitive user data and system resources. However, this particular implementation error allows for a scenario where an extension holds a dangling pointer to previously allocated memory that may have been repurposed for other operations. When the compromised code attempts to dereference this invalid pointer, it accesses arbitrary locations in the process's virtual address space rather than crashing or being blocked by standard safety checks.
The operational impact of this vulnerability is severe due to its potential for remote exploitation via a crafted HTML page. An attacker can construct a malicious webpage that triggers specific JavaScript execution paths within an installed extension, thereby inducing the use-after-free condition. Because Chrome extensions typically run with elevated privileges compared to regular web pages, successfully exploiting this flaw allows code execution outside the strict sandbox environment enforced by the browser's multi-process architecture. This bypass of sandboxing is particularly dangerous as it grants the attacker a level of access that can lead to arbitrary code execution on the victim's machine. The severity rating of Medium reflects the complexity required to reliably exploit the race condition or memory state manipulation involved, but the resulting impact remains critical due to the loss of isolation guarantees.
From a technical classification perspective, this flaw aligns with CWE-416, which defines use-after-free errors as accessing memory after it has been freed, leading to undefined behavior and potential security breaches. The exploitation technique leverages ATT&CK tactic T1059, specifically command and script interpretation through JavaScript, combined with privilege escalation techniques that bypass container or sandbox restrictions (T1610). The attacker utilizes the browser's own extension framework as a vector for initial access and subsequent lateral movement within the local system context. This highlights the risk associated with third-party code running within privileged contexts, where even minor memory management errors can have disproportionate security consequences.
Mitigation strategies primarily involve updating Google Chrome to version 153.0.8010.36 or later on macOS systems, as this release contains patches that correct the lifecycle management of extension objects and prevent the retention of dangling pointers. Administrators should ensure automated update policies are in place to minimize exposure windows for end-users who may not manually check for browser updates regularly. Additionally, organizations relying heavily on Chrome extensions should audit their installed add-ons for necessity and trustworthiness, removing any that are unused or from unverified publishers. Implementing strict content security policies within custom extensions can also reduce the attack surface by limiting the types of scripts and resources that can be executed during a session.