External risk intelligence

Chrome WebPackaging Use After Free Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-87634

This vulnerability exists within a web browser client. Exploitation requires a user to interact with a crafted HTML page, making it a client-side attack vector rather than a public-facing service, gateway, or internet-accessible appliance.

Use After Free

Google Chrome

before 153.0.8010.36

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This CVE relates to a use-after-free vulnerability in Google Chrome's WebPackaging component. While the Chromium security severity is rated as Low, it could potentially allow a remote attacker to execute arbitrary code outside the sandbox via a specially crafted HTML page, though exploitation requires user interaction. The main concern is confirming its relevance and exposure within your environment given the client-side nature of the attack vector.

Flaw in web browser component allows code execution.
User interaction needed for exploitation.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could trick a user into visiting a malicious webpage that exploits a flaw in how Chrome handles certain web packages. This could allow the attacker to execute code on the user's computer, potentially bypassing security restrictions.

Entry condition: Malicious webpage access.
Trigger point: Flawed web package handling.
Resulting risk: Code execution outside sandbox.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability, when supported by the advisory's conditions, could allow a remote attacker to execute arbitrary code outside the sandbox by tricking a user into visiting a malicious HTML page. This could affect system data and service behavior.

System data and service behavior at risk.
Via a crafted HTML page.
Potentially execute arbitrary code.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Google Chrome's WebPackaging component, rated as Low by Chromium but Critical by CVSS, requires a user to visit a malicious HTML page to exploit. Technical leaders and system owners should first confirm the presence and reachability of affected Chrome versions, then identify the asset owners responsible for the endpoints where Chrome is deployed. Remediation planning should prioritize business-critical systems and consider the low severity rating from the Chromium team alongside the high CVSS score.

Identify affected Chrome deployments and owners.
Verify user exposure to malicious HTML.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Google Chrome WebPackaging?

WebPackaging is a component within the Google Chrome browser designed to manage the loading and bundling of web resources. It helps browsers process packages of web content efficiently, which can improve how pages are loaded and rendered. Because it handles incoming data structures, the browser must carefully manage the memory assigned to these resources to prevent errors during operation.

What does a use-after-free weakness mean for CVE-2026-87634?

A use-after-free is a memory management error that occurs when software continues to use a memory location after it has been cleared or released. In the context of CVE-2026-87634, this means the WebPackaging component improperly tracks memory, which a clever attacker could theoretically manipulate to run unauthorized commands on your computer instead of just crashing the browser.

How does an attacker trigger this Chrome vulnerability?

To trigger this, an attacker must successfully convince a user to navigate to a specifically crafted, malicious HTML page. The vulnerability does not activate simply by having the browser installed or running in the background; it requires the user to actively interact with the malicious content, which then exploits the flawed handling of web packages.

Is CVE-2026-87634 a risk for my public-facing servers?

According to Halo Surface Signal, this is very unlikely. Because this flaw exists within the client-side browser software rather than a public-facing service, gateway, or appliance, it does not typically expose your backend infrastructure directly to network-based attacks. The primary risk remains confined to the user workstations or endpoints where the Chrome browser is actively used.

What should I do if my systems use affected Chrome versions?

Your first step is to identify where Chrome is deployed across your organization and determine which users or departments are using the vulnerable versions. Since this requires user interaction to exploit, prioritize updating browser software on endpoints that handle sensitive tasks or are most likely to access untrusted web content, following standard software update cycles.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.