Loading vulnerability…
Use-after-free memory disclosure in Google Chrome V8
CVE-2026-87657 is a use-after-free vulnerability in the V8 engine in Google Chrome versions earlier than 153.0.8010.36. A remote attacker who has already compromised the renderer process can exploit the flaw through a crafted HTML page to read memory within the browser sandbox. Chromium classifies the vulnerability as Medium severity.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation exposes memory within the browser sandbox, potentially disclosing sensitive information held there. This vulnerability does not independently establish renderer compromise, sandbox escape, arbitrary code execution, or integrity and availability impacts.
If you can’t patch tonight, do this now.
No CVE-specific workaround is documented. Until updates are deployed, restrict use of vulnerable browser installations and reduce exposure to untrusted web content. Maintain browser sandboxing and isolation controls as defense in depth; these controls do not remediate the flaw or prevent the documented memory disclosure within the sandbox.
Patch, then assume compromise.
Upgrade Google Chrome to version 153.0.8010.36 or later. For Debian stable (trixie), upgrade Chromium to 153.0.8010.47-2~deb13u1 or later. For Prisma Browser, version 153.3.3.37 addresses this CVE; version 155.16.5.40 or later addresses the complete October Chromium security update.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.