CVE-2026-87607: 
Google Chrome vulnerability analysis and mitigation

CVE-2026-87607 is a use-after-free vulnerability in the Device component of Google Chrome on macOS, allowing a remote attacker to potentially execute arbitrary code outside the browser sandbox via a crafted HTML page. It was reported to Google on August 26, 2026, and publicly disclosed on September 8–9, 2026, as part of the Chrome 153 stable channel release. The vulnerability affects all versions of Google Chrome prior to 153.0.8010.36 on Mac. It carries a CVSS v3.1 base score of 9.6 (Critical) (Github Advisory, Chrome Release).

The vulnerability is classified as CWE-416 (Use After Free), occurring in Chrome's Device component on macOS. A use-after-free condition arises when memory associated with a device-related object is freed but subsequently referenced, allowing an attacker to manipulate the freed memory region. Exploitation requires a user to visit a specially crafted HTML page, after which the attacker can leverage the memory corruption to achieve code execution outside Chrome's sandbox. The bug was tracked internally as Chromium issue 553122131 and was reported by Google's own security team (Github Advisory, Chrome Release).

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary code outside Chrome's sandbox on macOS systems, effectively bypassing the browser's primary security boundary. This can result in full compromise of the host system, including unauthorized access to sensitive data (high confidentiality impact), modification of system files or data (high integrity impact), and disruption of system availability. The changed scope in the CVSS vector reflects that the impact extends beyond the browser process itself to the underlying operating system (Github Advisory).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation for CVE-2026-87607 specifically (Github Advisory). The EPSS score is approximately 0.256–0.423%, placing it in the 36th percentile for exploitation likelihood within 30 days. The NVD SSVC assessment notes exploitation as "none" and the attack is not automatable due to the required user interaction. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Notably, the same Chrome 153 release does include a separate CVE (CVE-2026-87491) for which an in-the-wild exploit exists, but this does not apply to CVE-2026-87607 (Chrome Release).

1. Reconnaissance: Identify macOS users running Google Chrome versions prior to 153.0.8010.36 using social engineering, phishing infrastructure, or browser fingerprinting techniques.
2. Craft malicious HTML page: Develop a webpage that triggers the use-after-free condition in Chrome's Device component, manipulating object lifecycle to free and then reference a device-related memory object.
3. Deliver payload: Lure the target user into visiting the malicious page via phishing email, malicious advertisement, or compromised website — user interaction (page visit) is required.
4. Trigger use-after-free: The crafted HTML/JavaScript causes Chrome to free a Device component object and subsequently access the freed memory, enabling controlled memory corruption.
5. Achieve sandbox escape: Leverage the memory corruption primitive to execute arbitrary code in the context of the Chrome renderer process and then escape the sandbox to execute code at the OS level on the macOS host (Github Advisory, Chrome Release).

• Network: Unexpected outbound connections from the Chrome process to unknown external IPs or C2 infrastructure following a web page visit; unusual DNS queries originating from the browser process.
• Process: Suspicious child processes spawned by Google Chrome on macOS (e.g., bash, sh, curl, python, or other shells/utilities not normally launched by Chrome); Chrome renderer process making system calls inconsistent with normal browser activity.
• File System: Unexpected files written to user home directories, /tmp, or application support folders by the Chrome process; new launch agents or daemons created under ~/Library/LaunchAgents/ or /Library/LaunchDaemons/.
• Logs: macOS Unified Log entries showing Chrome accessing device-related APIs in an anomalous sequence; crash reports or memory error logs from Chrome around the time of exploitation.

Google has patched this vulnerability in Chrome 153.0.8010.36 (Linux) and 153.0.8010.36/.37 (Windows/Mac). Users and administrators should immediately update Google Chrome to version 153.0.8010.36 or later via the browser's built-in update mechanism or enterprise update management tools. No configuration-based workaround is available; updating to the patched version is the only remediation. Organizations should enforce browser update policies to ensure all macOS endpoints are running the patched version promptly (Chrome Release).

The Chrome 153 release attracted broad coverage due to the unusually large number of security fixes (230 total), with outlets such as CyberPress noting the scale of the update. Beyond Machines and other security news aggregators highlighted the release, particularly the presence of a zero-day (CVE-2026-87491) in the same batch, which drew attention to the overall release. CVE-2026-87607 itself did not receive significant individual commentary separate from the broader Chrome 153 security update coverage (Chrome Release).