External risk intelligence

Chrome DevTools Use-After-Free Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-87448

The vulnerability exists in a web browser, which is a client-side application designed to render untrusted content from the public internet. Because users frequently navigate to arbitrary web pages, the attack surface is considered likely to be exposed to internet-sourced content in typical deployment scenarios.

Use After Free

Google Chrome

before 153.0.8010.36

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A use-after-free vulnerability in Google Chrome's DevTools could allow an attacker to execute code outside the browser's security sandbox by luring a user to a malicious webpage. While this vulnerability is rated as low severity and requires user interaction, its presence in a widely used browser warrants attention to confirm if our specific environment is affected.

A code execution flaw exists in Chrome DevTools.
It could allow attackers to run code outside the sandbox.
Confirm relevance and exposure to this low-severity issue.

Attack Path

How an attacker could exploit the issue

An attacker can target users by luring them to a malicious webpage. This webpage, when loaded by a vulnerable version of Google Chrome, can trigger a use-after-free flaw within the DevTools component. Successfully exploiting this vulnerability could allow the attacker to execute arbitrary code, potentially escaping the browser's sandbox.

Remote attacker can reach the vulnerable component.
Malicious HTML page triggers the vulnerability.
Arbitrary code execution outside sandbox.

Live Threat

Current exploitation, exposure, and threat context

A use-after-free vulnerability in DevTools within Google Chrome could allow a remote attacker to execute arbitrary code outside the sandbox when a user visits a specially crafted HTML page.

Arbitrary code execution.
User visits malicious webpage.
Compromise of user session data.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in Chrome's DevTools requires immediate attention from teams managing end-user computing environments and application delivery. The first step is to identify all Chrome instances, assess their exposure to potentially malicious websites, and confirm which business-critical functions rely on these browsers. Once identified, a plan for remediation, potentially involving coordinated updates or the implementation of temporary risk-reduction measures, should be executed by the accountable owners.

End-user computing and platform teams own remediation.
Verify Chrome instances and reachability.
Plan targeted updates or risk reduction.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Google Chrome and how does its DevTools component work?

Google Chrome is a web browser used for navigating the internet. It includes built-in Developer Tools (DevTools) that allow web developers to inspect, debug, and optimize websites. DevTools provides deep access to a page's structure and execution flow, effectively acting as an advanced diagnostic suite within the browser environment.

What does the use-after-free weakness mean in CVE-2026-87448?

A use-after-free is a memory management error identified as CWE-416. It occurs when a program continues to use a memory location after that memory has been cleared or released. If an attacker can manipulate this process, they may be able to store malicious instructions in that freed memory, which the browser then inadvertently executes.

How is this Chrome vulnerability triggered?

The flaw is triggered when a user visits a specifically crafted HTML page designed to exploit the DevTools component. Simply having the browser installed is not enough; the vulnerability requires the browser to render the malicious content. It is not triggered by legitimate, safe web traffic or internal browser functions that do not involve external page rendering.

Why does Halo Surface Signal consider this CVE likely to be exposed?

Halo Surface Signal labels this as likely because Chrome is a client-side application inherently designed to process content from the public internet. Since users frequently navigate to arbitrary websites, the browser acts as a primary interface for internet-sourced code, making it a natural target for flaws that rely on rendering external webpages.

How should I respond to the Chrome DevTools vulnerability?

Start by identifying all instances of Google Chrome within your environment to determine which systems are running versions prior to 153.0.8010.36. Coordinate with the teams responsible for end-user computing to prioritize updates across those systems. While planning your deployment, focus on confirming which critical business functions rely on the browser to ensure stability during the update process.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.