CVE-2026-87657: 
vulnerability analysis and mitigation

CVE-2026-87657 is a use-after-free vulnerability in the V8 JavaScript engine in Google Chrome that allows a remote attacker who has already compromised the renderer process to read memory inside the sandbox via a crafted HTML page. It affects all Google Chrome versions prior to 153.0.8010.36 on Windows, Mac, and Linux. The vulnerability was reported by Jihyeon Jeong (Compsec Lab, Seoul National University) on August 3, 2026, and publicly disclosed on September 8–9, 2026, as part of the Chrome 153 stable channel release. It carries a CVSS v3.1 base score of 3.1 (Low), reflecting its constrained exploitation preconditions (GitHub Advisory, Chrome Release).

The vulnerability is classified as CWE-416 (Use After Free), occurring within Chrome's V8 JavaScript engine. A use-after-free condition arises when V8 references a memory region that has already been deallocated; an attacker who has already gained control of the renderer process can craft a malicious HTML page that triggers this condition to read arbitrary memory contents within the sandbox boundary. Exploitation requires high attack complexity, user interaction (visiting a crafted page), and a pre-compromised renderer process — meaning this vulnerability is a post-exploitation primitive rather than an initial access vector. The Chromium issue tracker reference is bug #542146471 (GitHub Advisory, Chrome Release).

Successful exploitation enables a remote attacker with an already-compromised renderer process to read memory contents inside Chrome's sandbox, resulting in a limited confidentiality impact (low) with no integrity or availability impact. The vulnerability does not by itself enable sandbox escape or code execution, but could be chained with other vulnerabilities to leak memory layout information useful for bypassing ASLR or other mitigations. The scope of impact is confined to the sandbox environment of the affected Chrome process (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation for CVE-2026-87657 as of the time of disclosure. The EPSS score is approximately 0.246% (roughly the 7th percentile), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Notably, a separate vulnerability in the same Chrome 153 release — CVE-2026-87491 — does have a known in-the-wild exploit, but CVE-2026-87657 does not (GitHub Advisory, Chrome Release).

Google has patched this vulnerability in Chrome 153.0.8010.36 (Linux) and 153.0.8010.36/.37 (Windows/Mac), released on September 8, 2026. Users should update Google Chrome to version 153.0.8010.36 or later immediately. Enabling automatic updates ensures timely receipt of security patches. As an additional defense-in-depth measure, organizations should consider restricting access to untrusted websites and enforcing content security policies to reduce the risk of renderer process compromise that is a prerequisite for this vulnerability (Chrome Release, Microsoft MSRC).

The Chrome 153 release, which includes the fix for CVE-2026-87657, received coverage from security news outlets including GBHackers and CyberPress, which highlighted the large number of security fixes (230 total) in the release. No specific researcher commentary or notable social media discussion focused exclusively on CVE-2026-87657 was identified, as attention was largely directed toward the more severe CVE-2026-87491, for which Google confirmed an in-the-wild exploit exists (Chrome Release).