CVE-2026-87429 Overview
CVE-2026-87429 is a missing authorization vulnerability [CWE-862] in the ServiceWorker component of Google Chrome prior to version 153.0.8010.36. A remote attacker who has already compromised the renderer process can bypass system access restrictions by serving a crafted HTML page. Chromium's security team rated the underlying issue as Low severity, while the CVSS score reflects the integrity impact once a renderer foothold exists. Exploitation requires user interaction, such as loading attacker-controlled content in the browser.
Critical Impact
Attackers with an existing renderer compromise can bypass ServiceWorker authorization checks to escape sandbox-enforced access restrictions and tamper with protected browser state.
Affected Products
- Google Chrome versions prior to 153.0.8010.36 (Desktop Stable channel)
- Chromium-based browsers embedding vulnerable ServiceWorker code
- Downstream distributions shipping pre-patch Chrome builds
Discovery Timeline
- 2026-09-09 - CVE-2026-87429 published to NVD
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-87429
Vulnerability Analysis
The flaw resides in Chrome's ServiceWorker implementation, which mediates background script execution, cache access, and message routing between web origins and the browser process. ServiceWorker enforces same-origin and capability checks before granting access to sensitive resources. In vulnerable builds, one or more of those authorization checks are missing, allowing a compromised renderer to invoke privileged ServiceWorker paths that should be inaccessible.
The classification [CWE-862] Missing Authorization indicates that the code executes the requested operation without verifying that the caller is entitled to perform it. Because ServiceWorkers persist across navigations and can proxy network requests, bypassing these checks lets an attacker manipulate state that outlives a single page load.
Root Cause
The root cause is an authorization gap in the ServiceWorker IPC surface exposed to the renderer process. Chrome's renderer is intentionally treated as untrusted, and the browser process is responsible for validating every privileged request. The missing check allows renderer-issued calls to reach system access paths that assume prior authorization has already been performed.
Attack Vector
Exploitation requires two conditions: an already-compromised renderer process and user interaction to load a crafted HTML page. An attacker chains this issue with a separate renderer exploit, then uses the crafted page to trigger the ServiceWorker code path that skips the authorization check. The result is an integrity impact on browser-mediated state, with no direct confidentiality or availability loss reported.
See the Chromium Issue Tracker #497025031 for technical details once access restrictions are lifted.
Detection Methods for CVE-2026-87429
Indicators of Compromise
- Chrome browser processes running versions earlier than 153.0.8010.36 on managed endpoints
- Unexpected ServiceWorker registrations persisting across browsing sessions on user profiles
- Renderer process crashes or sandbox violations preceding anomalous ServiceWorker activity
Detection Strategies
- Inventory installed Chrome versions across the fleet and flag any build below 153.0.8010.36
- Monitor endpoint telemetry for renderer process anomalies, such as unexpected child processes or IPC patterns
- Correlate browsing telemetry with ServiceWorker registration events sourced from Chrome enterprise reporting
Monitoring Recommendations
- Enable Chrome Enterprise reporting to capture version compliance and extension telemetry centrally
- Ingest browser and endpoint logs into a centralized analytics platform to detect exploit chaining behavior
- Alert on Chrome installations that fall behind the current Stable channel release for more than one patch cycle
How to Mitigate CVE-2026-87429
Immediate Actions Required
- Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints
- Restart Chrome after update to ensure the patched binaries and ServiceWorker code are loaded
- Audit Chromium-based applications and embedded browser frameworks for equivalent patch levels
Patch Information
Google addressed CVE-2026-87429 in the Stable channel update announced in the Google Chrome Stable Update advisory. Administrators should deploy Chrome 153.0.8010.36 or later. Enterprise deployments using Chrome Browser Cloud Management or group policy should verify auto-update enforcement to prevent rollback.
Workarounds
- No vendor-supplied workaround exists; apply the patched Chrome build as the primary remediation
- Restrict browsing to trusted sites via enterprise policy until patching completes
- Disable unnecessary ServiceWorker functionality through site-level permissions where operationally feasible
# Verify installed Chrome version on Linux endpoints
google-chrome --version
# Windows registry check for enforced auto-update (Chrome Enterprise)
reg query "HKLM\Software\Policies\Google\Update" /v UpdateDefault
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.