CVE-2026-87628 is a use-after-free vulnerability (CWE-416) in the Cast feature of Google Chrome before version 153.0.8010.36. Exploitation requires an adjacent attacker to send specially crafted network traffic, which may lead to arbitrary code execution outside the sandbox environment. This vulnerability affects the browser's memory management in the Cast component, potentially allowing control over program flow after the use of freed memory. No public exploit is known, and no official patch or remediation details are currently available.

If exploited, this vulnerability could allow an attacker on the same network segment to execute arbitrary code outside the Chrome sandbox, potentially compromising the host system. This elevates the risk of remote code execution with the privileges of the user running Chrome. However, no known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should minimize exposure to untrusted adjacent networks and consider disabling the Cast feature if feasible.