CVE-2026-87633

CVE-2026-87633 is a use-after-free memory corruption flaw (CWE-416) in the Views component of Google Chrome, the code that renders the browser's UI. A local attacker can trigger the flaw by getting a user to perform crafted UI interactions, which frees an object that is then reused by the browser. Successful exploitation allows arbitrary code execution outside the browser's sandbox, meaning an attacker who already has a foothold on the machine can escape Chrome's security containment and run code with broader privileges. All users running Google Chrome prior to 153.0.8010.36 are affected. There is currently no public proof-of-concept, no evidence of exploitation in the wild, the flaw is not in CISA's KEV catalog, and EPSS estimates only a 0.2% chance of exploitation in the next 30 days.

What to do: Update Google Chrome to version 153.0.8010.36 or later on all endpoints, including managed fleets via enterprise update policies. Because exploitation requires a local attacker, prioritize patching shared, multi-user, and kiosk-style systems where untrusted users interact with the browser. No workarounds are documented, so verify installed versions in your inventory and confirm browsers auto-update once the fix rolls out.