Executive brief
Google Chrome is a web browser used by billions of people to access websites and web applications. A use-after-free vulnerability in Chrome's browser component allows remote attackers to execute arbitrary code outside the sandbox by convincing users to visit a malicious webpage, potentially compromising user data, credentials, and system security. The vulnerability affects Windows versions prior to 153.0.8010.36.
Technical details
This is a use-after-free vulnerability in Google Chrome's Browser component, a memory safety issue where freed memory is accessed again. The vulnerability is exploited via a crafted HTML page delivered through social engineering, making it a network-based attack requiring user interaction. The critical aspect is that successful exploitation allows code execution outside Chrome's sandbox, breaking the isolation boundary that normally constrains browser exploits. The vulnerability was patched in Chrome 153.0.8010.36 and later versions released on September 8, 2026.
Affected products
- Google Chrome prior to 153.0.8010.36 on Windows
Timeline
- 2026-09-09: disclosed: CVE-2026-87494 published on NVD
- 2026-09-08: patched: Fixed in Chrome 153.0.8010.36 released to stable channel