Executive brief
Google Chrome's developer tools contain a use-after-free vulnerability that allows attackers to execute arbitrary code outside the browser's sandbox by hosting a specially crafted HTML page. If an attacker tricks a developer into visiting a malicious page with DevTools open, the attacker gains the ability to run code with the full privileges of the user's system, potentially compromising sensitive development credentials, source code, and other data.
Technical details
A use-after-free vulnerability exists in Chrome's DevTools component (versions prior to 153.0.8010.36). The vulnerability is triggered when DevTools processes a malicious HTML page, allowing an attacker to access memory that has already been freed, leading to arbitrary code execution outside the sandbox boundary. The attack requires user interaction (visiting a crafted HTML page with DevTools active) and network access. Successful exploitation bypasses Chrome's sandbox isolation, granting an attacker full system-level code execution. The vulnerability is patched in Chrome 153.0.8010.36 and later.
Affected products
- Google Chrome prior to 153.0.8010.36
Timeline
- 2026-09-09: disclosed: CVE-2026-87448 published
- 2026-09-08: patched: Chrome 153.0.8010.36 released with fix