CVE-2026-87536

CVE-2026-87536 is a use-after-free memory-safety flaw (CWE-416) in V8, the JavaScript and WebAssembly engine of Google Chrome, affecting builds prior to 153.0.8010.36. A remote attacker can trigger it by persuading a user to open a crafted HTML page, requiring no privileges but user interaction per the CVSS vector (AV:N/PR:N/UI:R). Successful exploitation allows the attacker to execute arbitrary code inside the Chrome sandbox, compromising the browser's content process, although the sandbox limits further access to the underlying operating system. Google rates the flaw High (CVSS 3.1: 8.8) and shipped the fix in Chrome 153.0.8010.36, part of a release containing 230 security fixes. News coverage of the release describes a zero-day exploited in the wild; while no public proof-of-concept is known and the CVE is not yet in CISA's KEV, defenders should treat active exploitation as likely given the in-the-wild reporting tied to this release.

What to do: Upgrade Google Chrome to 153.0.8010.36 or later on all endpoints (verify the version via chrome://settings/help) and enforce the update across managed fleets via enterprise update-management policies, since merely visiting attacker-controlled web content is the attack vector. Because V8 is shared across the Chromium ecosystem, expect Chromium-based browser vendors to follow with equivalent V8 fixes and apply those updates as they are released.