Is CVE-2026-87607 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-87607 being exploited in the wild.

How severe is CVE-2026-87607?

Critical severity, with a CVSS score of 9.6, published 9 September 2026.

Which products and versions are affected?

Google Chrome prior to 153.0.8010.36 on Mac.

Is there a fix for CVE-2026-87607?

A patch was published on 2026-09-08: Chrome 153.0.8010.36 released to stable channel Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-87607 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-87607?

Check whether you run Apple macOS or Google Chrome at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-87607: Google Chrome use-after-free in Device on Mac

CVE-2026-87607 · Severity: critical · CVSS 9.6 · Published 2026-09-09

Google Chrome on macOS contained a memory safety vulnerability that could allow an attacker to execute malicious code outside the browser's security sandbox by tricking a user into visiting a crafted webpage. This could lead to complete system compromise, theft of user data, or unauthorized access to sensitive information stored on the device.

Technologies: Apple macOS, Google Chrome. Vendors: Apple, Google.

Quick answers

Is CVE-2026-87607 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-87607 being exploited in the wild.
How severe is CVE-2026-87607?: Critical severity, with a CVSS score of 9.6, published 9 September 2026.
Which products and versions are affected?: Google Chrome prior to 153.0.8010.36 on Mac.
Is there a fix for CVE-2026-87607?: A patch was published on 2026-09-08: Chrome 153.0.8010.36 released to stable channel Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-87607 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-87607?: Check whether you run Apple macOS or Google Chrome at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a use-after-free vulnerability in the Device component of Google Chrome on macOS, where memory is accessed after it has been freed, allowing attackers to corrupt the heap and gain code execution. The vulnerability is triggered through a malicious HTML page delivered over the network; no authentication or elevated privileges are required. An attacker can exploit this to execute arbitrary code outside Chrome's sandbox, bypassing the browser's primary isolation mechanism. The vulnerability was patched in Chrome version 153.0.8010.36 released on September 8, 2026.

Affected products

Google Chrome prior to 153.0.8010.36 on Mac

Timeline

2026-09-09: disclosed: CVE-2026-87607 disclosure
2026-09-08: patched: Chrome 153.0.8010.36 released to stable channel

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.