External risk intelligence

Google Chrome Aura Use After Free Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-87455

This vulnerability exists within the client-side browser's rendering engine. It requires a user to interact with a specifically crafted HTML page within the browser application itself. It is not a network-accessible service, gateway, or internet-facing endpoint, making it highly unlikely to be exposed to the public internet as a reachable attack surface.

Use After Free

Google Chrome

before 153.0.8010.36

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A use-after-free vulnerability in the Aura component of Google Chrome could allow a remote attacker to execute arbitrary code outside the sandbox by tricking a user into visiting a malicious webpage. While the Chromium security severity is noted as Medium, the CVSS v3.1 score indicates a Critical risk. The main concern is confirming relevance and exposure, as the vulnerability requires user interaction with a crafted HTML page within the browser.

Code execution flaw in web browsing technology.
Potentially critical risk requires understanding relevance.
Assess impact; focus on user-facing browser use.

Attack Path

How an attacker could exploit the issue

An attacker could trick a user into visiting a malicious webpage that exploits a use-after-free vulnerability in the Chrome browser's Aura component. This could allow the attacker to execute code on the user's computer, potentially bypassing security sandboxes.

Requires a user to visit a malicious site.
Triggered by a crafted HTML page.
May lead to arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

A use-after-free vulnerability in the Aura component of Chrome could allow a remote attacker to execute code outside the browser's sandbox when a user visits a malicious HTML page. This could potentially impact the security and stability of the user's browser session.

Browser sandbox integrity.
Malicious HTML page interaction.
Potential for arbitrary code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Aura component's use-after-free vulnerability in Google Chrome requires user interaction with a malicious HTML page, suggesting that product owners and security teams should prioritize identifying and assessing user-facing Chrome deployments. The first practical step involves confirming the reachability and business criticality of affected Chrome instances, identifying accountable owners, and then planning remediation or mitigation based on the assessed risk.

Issue ownership by product/application teams.
Verify user exposure and critical deployments.
Plan remediation during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Aura component in Google Chrome?

Aura is the underlying window management and rendering library used by Google Chrome. It handles how the browser draws user interface elements and displays web content on your screen. Because it sits at the intersection of your operating system and the web pages you visit, flaws here can affect how the browser interacts with your computer's memory.

What does a use-after-free vulnerability mean in CVE-2026-87455?

This vulnerability is a memory management error classified as CWE-416. It occurs when a program continues to use a pointer to a specific memory location after that memory has already been cleared or freed. If an attacker can manipulate this process, they may be able to force the browser to perform unauthorized actions or execute arbitrary code.

How is this Chrome vulnerability triggered?

To trigger the bug, a user must navigate to a specially crafted, malicious HTML page using an affected version of Google Chrome. The vulnerability does not activate simply by having the browser installed or running in the background. It specifically requires the browser to process malicious code embedded within a webpage during a user's browsing session.

Is this vulnerability a risk for my servers?

According to Halo Surface Signal, this is highly unlikely to be a direct network risk because it exists within the client-side browser rendering engine. It is not a network-accessible service or gateway. The primary concern is for endpoints where users actively browse the internet, rather than internal server infrastructure that does not perform general web browsing.

What should I do if I use Google Chrome?

The most effective practical step is to ensure your Chrome browser is updated to version 153.0.8010.36 or higher. Prioritize identifying systems where users frequently access external websites. Once those priority systems are identified, confirm that the update is applied to those browsers to mitigate the potential for unauthorized code execution.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.