CVE-2026-87504 is a use-after-free vulnerability (CWE-416) in the Core of Google Chrome before version 153.0.8010.36. Exploitation requires social engineering to convince a user to install a malicious Chrome extension, which then enables execution of arbitrary code outside the browser sandbox. The vulnerability is rated medium severity by Chromium security. No CVSS score or known active exploitation is currently documented. No vendor advisory or patch link is provided in the data, but the fixed version is implied to be 153.0.8010.36 or later.

Successful exploitation allows remote attackers to execute arbitrary code outside the sandbox environment by leveraging a crafted Chrome extension and social engineering. This could compromise the security boundaries of the browser, potentially leading to further system compromise. However, no known exploits in the wild have been reported to date.

Since the vulnerability is fixed in Google Chrome version 153.0.8010.36, users and administrators should update to this version or later to remediate the issue. Patch status is not explicitly confirmed in the provided data, so verify with official Google Chrome security advisories for the latest remediation guidance.