CVE-2026-87637

CVE-2026-87637 is a use-after-free (CWE-416) in the Extensions component of Google Chrome on macOS, fixed in Chrome 153.0.8010.36. It is triggered remotely when a user's browser loads a crafted HTML page, which corrupts memory in the affected component. An attacker who successfully exploits it can execute arbitrary code outside the Chrome sandbox on the Mac, meaning a compromise that escapes Chrome's renderer isolation rather than remaining confined to a browser tab. Only Chrome builds prior to 153.0.8010.36 on Mac are affected per the advisory; Chrome on other operating systems is not listed. As of this analysis there is no public proof-of-concept, the issue is not in CISA KEV, and EPSS puts 30-day exploitation probability at just 0.3%, with no confirmed reports of in-the-wild exploitation.

What to do: Update Chrome on Mac to 153.0.8010.36 or later (check chrome://settings/help or use enterprise update management) and restart the browser to complete the update. No workarounds are documented, so unpatched Macs should be treated as carrying residual risk until updated, and users should avoid opening untrusted links in the interim. Enterprises should verify patched versions across managed Mac fleets using MDM/EMM browser-version reporting.