Loading vulnerability…
Sandboxed code execution via V8 use-after-free in Google Chrome
CVE-2026-87587 is a use-after-free vulnerability in the V8 engine in Google Chrome versions earlier than 153.0.8010.36. A remote attacker can trigger the flaw through a crafted HTML page and execute arbitrary code inside the browser sandbox. Chromium classifies the vulnerability as High severity. The vulnerability does not establish a sandbox escape.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows arbitrary code execution within the affected browser sandbox, potentially compromising confidentiality, integrity, and availability within that security boundary. Execution outside the sandbox or compromise of the underlying operating system is not established for this vulnerability alone.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is documented. Until patched, restrict use of affected browsers and exposure to untrusted web content, apply enterprise web filtering or browser isolation where available, and retain browser sandboxing and endpoint protections. These controls reduce exposure but do not correct the use-after-free.
Patch, then assume compromise.
Upgrade Google Chrome to version 153.0.8010.36 or later, using the applicable platform release; macOS guidance specifies 153.0.8010.37 or later. Update Chromium and related packages to vendor-provided fixed releases. For Debian stable (trixie), install chromium 153.0.8010.47-2~deb13u1 or later. Prisma Browser release 153.3.3.37 includes the fix for this CVE; version 155.16.5.40 or later addresses the complete October Chromium security advisory.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.