Use after free in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read memory… (CVE-2026-87657)
Source GCVE Database
Not known to be exploited.
Data as of 10/25/2026, 04:40:14 UTC
CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 13% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
What to do
AI-suggested
Users should monitor official Google Chrome security advisories for updates and apply updates promptly once a fix is released.
Description
A use-after-free vulnerability exists in the V8 JavaScript engine of Google Chrome versions prior to 153.0.8010.36. This vulnerability allows a remote attacker who has already compromised the renderer process to read memory within the sandbox by delivering a crafted HTML page. The issue is classified as medium severity by Chromium security. There are no known exploits in the wild and no explicit patch information provided in the source data.
Impact
An attacker with control over the renderer process can exploit this vulnerability to read memory within the sandbox, potentially exposing sensitive information. However, exploitation requires prior compromise of the renderer process. The vulnerability is considered medium severity by the Chromium security team. No active exploitation has been observed.
Weaknesses
- CWE-416Use After Free (opens in a new tab)
Variant weaknessLikelihood of exploit: HighCWE Top 25 (2025): #7
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.