CVE-2026-87494: Use after free in Google Chrome

CVE-2026-87494 is a use-after-free vulnerability in Google Chrome's Browser on Windows platforms before version 153.0.8010.36. Exploitation requires social engineering to lure a user to a maliciously crafted HTML page, enabling remote code execution outside the sandbox environment. The vulnerability is rated medium severity by Chromium security. There is no CVSS score or explicit remediation level provided in the available data. The vendor advisory link points to a Chrome stable channel update announcement but does not explicitly confirm if this version fixes the issue.

Successful exploitation could allow a remote attacker to execute arbitrary code outside the Chrome sandbox on affected Windows systems. This could lead to compromise of the user's environment with the privileges of the browser process. The attack requires user interaction via social engineering. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html for current remediation guidance. Users should update to the latest stable Chrome version once the fix is confirmed. Until then, exercise caution with untrusted web content and avoid clicking suspicious links.