CVE-2026-87504

CVE-2026-87504 is a use-after-free (CWE-416) in the Core component of Google Chrome, patched in Chrome 153.0.8010.36. A remote attacker triggers it by using social engineering to convince a victim to install or interact with a crafted Chrome extension, causing memory corruption in the browser's Core component. Successful exploitation yields arbitrary code execution outside Chrome's security sandbox, meaning the attacker gains control at the operating-system level rather than being confined to a renderer process. Everyone running Chrome before 153.0.8010.36 is affected, which in practice means nearly the entire Chrome install base. Chrome 153 shipped 230 vulnerability fixes, and related reporting indicates one of those fixes was a 0-day exploited in the wild; this issue has no known public proof-of-concept, is not in CISA KEV, carries a low 0.2% EPSS score, and was rated Medium by Chromium because exploitation requires user interaction.

What to do: Update Chrome to 153.0.8010.36 or later immediately via Settings > About Chrome (then relaunch the browser) and verify the version at chrome://version; enterprise administrators should force the update through browser management policies. Until patched, warn users against installing or enabling extensions from untrusted sources, since the attack chain relies on social engineering around a crafted extension.