CVE-2026-87494: Use After Free

Q: Which systems are affected?

Google Chrome on Windows is affected when running a version earlier than 153.0.8010.36.

Q: What does an attacker need to exploit this issue?

The attacker must induce a user through social engineering to interact with a crafted HTML page. Exploitation is remote and can result in arbitrary code execution outside the browser sandbox.

Q: What should be prioritized for remediation?

Update Google Chrome on Windows to version 153.0.8010.36 or later. The provided information does not identify a workaround or mitigation for systems that cannot yet be updated.

Published Sep 9, 2026

Updated

Use after free in Browser in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Affected Software

1 affected component

Google Chrome<153.0.8010.36

Event History

Sep 9, 2026

CVE Published

via MITRE·12:09 AM

Data Sourced

via MITRE·12:09 AM

DescriptionWeakness

Frequently Asked Questions

Which systems are affected?

Google Chrome on Windows is affected when running a version earlier than 153.0.8010.36.

What does an attacker need to exploit this issue?

The attacker must induce a user through social engineering to interact with a crafted HTML page. Exploitation is remote and can result in arbitrary code execution outside the browser sandbox.

What should be prioritized for remediation?

Update Google Chrome on Windows to version 153.0.8010.36 or later. The provided information does not identify a workaround or mitigation for systems that cannot yet be updated.