CVE-2026-87625: Use After Free

Q: What must an attacker do to exploit this issue?

The attacker needs to persuade a user to interact with or install a crafted Chrome extension. Successful exploitation enables arbitrary code execution inside Chrome's sandbox.

Q: Which Chrome versions should be considered affected?

Google Chrome versions earlier than 153.0.8010.36 are affected. Update Chrome to 153.0.8010.36 or later.

Q: Who is most exposed if updates cannot be applied immediately?

Users who can be socially engineered into using a malicious or crafted Chrome extension are the relevant exposure group. Until Chrome is updated, avoid installing or interacting with untrusted extensions.

Published Sep 9, 2026

Updated

Use after free in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted Chrome extension. (Chromium security severity: Medium)

Affected Software

1 affected component

Google Chrome<153.0.8010.36

Event History

Sep 9, 2026

CVE Published

via MITRE·12:09 AM

Data Sourced

via MITRE·12:09 AM

DescriptionWeakness

Frequently Asked Questions

What must an attacker do to exploit this issue?

The attacker needs to persuade a user to interact with or install a crafted Chrome extension. Successful exploitation enables arbitrary code execution inside Chrome's sandbox.

Which Chrome versions should be considered affected?

Google Chrome versions earlier than 153.0.8010.36 are affected. Update Chrome to 153.0.8010.36 or later.

Who is most exposed if updates cannot be applied immediately?

Users who can be socially engineered into using a malicious or crafted Chrome extension are the relevant exposure group. Until Chrome is updated, avoid installing or interacting with untrusted extensions.