Full Report
Google security advisory (AV26-904)
Analysis Summary
# Vulnerability: Google Chrome Use-After-Free Vulnerability
## CVE Details
- **CVE ID:** CVE-2026-87491
- **CVSS Score:** Not explicitly listed in the advisory (Typically 8.8+ for similar Chrome exploits)
- **CWE:** CWE-416 (Use After Free)
## Affected Systems
- **Products:** Google Chrome / Chromium-based browsers
- **Versions:** All versions prior to 153.0.8010.37
- **Configurations:** Default desktop installations (Windows, macOS, and Linux)
## Vulnerability Description
While the provided advisory focuses on the exploitation status, CVE-2026-87491 is identified as a Use-After-Free (UAF) vulnerability within a core component of the Chrome browser. A UAF flaw occurs when a program continues to use a pointer after it has been freed, which can lead to the execution of arbitrary code, data corruption, or a program crash if an attacker provides specially crafted web content.
## Exploitation
- **Status:** **Exploited in the wild.** This vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.
- **Complexity:** Medium (Requires crafting a malicious webpage to trigger the memory corruption).
- **Attack Vector:** Network (Remote/Web-based).
## Impact
- **Confidentiality:** High (Potential for sensitive data theft via code execution).
- **Integrity:** High (Potential for unauthorized modification of browser data).
- **Availability:** High (Potential for application crashes).
## Remediation
### Patches
Google has released the following stable channel updates to address this flaw:
- **Windows/macOS/Linux:** Update to version **153.0.8010.37** or later.
### Workarounds
- No official workarounds provided. Users are strongly advised to apply the security update immediately due to active exploitation.
## Detection
- **Indicators of compromise:** Monitor for unusual Chrome crashes or unauthorized outbound network connections from the browser process.
- **Detection methods and tools:**
- Verify browser version via `chrome://settings/help`.
- Vulnerability scanners can detect outdated versions of `chrome.exe` or equivalent binaries.
- EDR solutions may detect exploitation attempts involving heap spray or memory corruption patterns.
## References
- **Google Stable Channel Update:** hxxps[://]chromereleases[.]googleblog[.]com/2026/09/stable-channel-update-for-desktop_0808145027[.]html
- **CISA KEV Catalog:** hxxps[://]www[.]cisa[.]gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87491
- **Canadian Centre for Cyber Security Advisory:** hxxps[://]www[.]cyber[.]gc[.]ca/en/alerts-advisories/google-security-advisory-av26-904