External risk intelligence

Google Chrome Use-After-Free Vulnerability Allows Arbitrary Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-87607

This vulnerability is located within the Google Chrome browser and requires a user to navigate to a crafted HTML page. As a client-side application, it is not deployed as an internet-facing service, gateway, or network-accessible management surface, making public exposure via typical network-based attack vectors not applicable to its deployment model.

Use After Free

Google Chrome

before 153.0.8010.36

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in Google Chrome on Mac could allow an attacker to run unauthorized code by tricking a user into visiting a malicious web page. This could potentially impact the confidentiality, integrity, and availability of user data and system functions.

Issue: Flaw in Chrome allows code execution from malicious websites.
Remember: Impacts widespread Chrome users on Mac systems.
Takeaway: Verify exposure to confirm relevance and impact.

Attack Path

How an attacker could exploit the issue

An attacker could entice a user to visit a malicious web page, which would then interact with a vulnerable component within the Google Chrome browser. This interaction could lead to the execution of arbitrary code, potentially allowing the attacker to bypass security boundaries and compromise the user's system.

Requires user to visit a malicious page.
Use-after-free in Device triggers vulnerability.
Potential for arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

A use-after-free vulnerability in Google Chrome on Mac could allow a remote attacker to execute arbitrary code outside the sandbox when a user visits a malicious HTML page. This could impact the confidentiality, integrity, and availability of the affected system.

System data and user data.
User visits a crafted HTML page.
Arbitrary code execution outside sandbox.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Google Chrome requires owner confirmation of affected assets, particularly business-critical instances reachable by remote attackers through a crafted HTML page. The first practical move is to identify all Chrome instances, assess their exposure and criticality, and then coordinate remediation with the accountable owner, potentially involving vendor updates if applicable.

Identify Chrome instances and owners.
Verify user interaction and criticality.
Plan vendor-supported updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Google Chrome?

Google Chrome is a widely used web browser that renders HTML, CSS, and JavaScript to display websites. It includes specialized internal components, such as the Device component mentioned in this CVE, which manage hardware interactions and system resources. Because it acts as the primary interface between the user and the internet, it must strictly manage how memory is allocated and freed to prevent security flaws.

What does a use-after-free vulnerability mean?

This is a memory management error classified as CWE-416. It occurs when a program continues to use a pointer to a memory address after that memory has been cleared or released. If an attacker can manipulate this state, they may be able to force the application to perform unintended actions or execute unauthorized code by replacing the original data with their own.

How is this Chrome vulnerability triggered?

The flaw is triggered when a user navigates to a specifically crafted HTML page designed to exploit the memory error. It does not activate simply by having the browser installed or running in the background. If a user does not visit the malicious site, the vulnerable code path remains idle, meaning automated background tasks or standard browsing of trusted sites will not cause the issue.

Why is this CVE relevant to my security posture?

Halo Surface Signal indicates that because Chrome is a client-side application, it is not an internet-facing server or gateway that hackers scan for remotely. The risk is tied to human behavior—specifically, whether users can be enticed to visit malicious content. You should prioritize this if your environment involves users who frequently navigate to untrusted or high-risk web destinations.

How do I respond to this threat?

The primary defense is to ensure your Chrome browser version is current. Since this issue is patched through vendor updates, confirm your Mac systems have applied the latest stable channel update. Start by identifying which systems in your fleet are running outdated versions, then coordinate with the users or device owners to ensure they restart the browser to complete the update process.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.