CVE-2026-87609

CVE-2026-87609 is a use-after-free vulnerability (CWE-416) in the Sharing component of Google Chrome on iOS, fixed in version 153.0.8010.36. A remote attacker can trigger the flaw via crafted network traffic, with user interaction required according to the CVSS vector (e.g., a user loading attacker-influenced content in the browser). Successful exploitation allows arbitrary code execution outside the Chrome sandbox, meaning attacker code runs with browser-process privileges on the device rather than being confined to the renderer. Only Chrome on iOS is named as affected in the advisory; Chrome on desktop and other platforms is not specified in this data. No public proof-of-concept, no CISA KEV listing, and an EPSS of 0.2% (15th percentile) indicate no known exploitation to date, and notably Google rates this Medium while the CVSS base score is 9.6.

What to do: Update Chrome for iOS to 153.0.8010.36 or later from the App Store, and verify browser versions on managed iOS fleets via MDM inventory. Because the flaw requires user interaction and no public exploit is known, no compensating mitigations are strictly required, but prioritize the update for users who browse untrusted content; continue monitoring Google's release notes for related iOS Chrome fixes.