CVE-2026-87431: Google Chrome Information Disclosure Flaw

CVE-2026-87431 Overview

CVE-2026-87431 is a missing authorization vulnerability [CWE-862] in the Extensions component of Google Chrome. The flaw affects Chrome versions prior to 153.0.8010.36. A remote attacker can obtain sensitive information by delivering a crafted Chrome extension to a target user. Chromium tracks the underlying issue at Chromium security severity Medium, while NVD scores it at 7.5 (High) due to the network attack vector and confidentiality impact.

Critical Impact
A crafted Chrome extension can bypass authorization checks in the Extensions subsystem and read sensitive browser data without user interaction.

Affected Products

Google Chrome Desktop versions prior to 153.0.8010.36
Chromium-based builds sharing the vulnerable Extensions component
Stable channel Chrome installations on Windows, macOS, and Linux

Discovery Timeline

2026-09-09 - CVE-2026-87431 published to the National Vulnerability Database (NVD)
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87431

Vulnerability Analysis

The defect resides in the Chrome Extensions subsystem, which enforces authorization boundaries between extensions, browser internals, and web content. Missing authorization checks allow a crafted extension to access resources or APIs that should require additional permission validation. The result is unauthorized disclosure of sensitive information from the browser context.

Exploitation requires an attacker to convince a user to install a crafted extension or leverage an already-installed extension that has been updated with malicious logic. Because the flaw affects confidentiality only, it does not permit code execution or persistent tampering with browser state. The Chromium Issue Tracker entry #523313374 documents the underlying defect.

Root Cause

The root cause is classified under CWE-862: Missing Authorization. The Extensions component fails to verify that a caller holds the required permission before returning protected data. When an extension invokes the affected code path, the browser services the request without validating scope. This lets a low-privilege extension read information intended only for higher-privilege callers or for the browser itself.

Attack Vector

The attack is delivered over the network through extension distribution channels or side-loaded packages. No user interaction is required beyond installing or updating the crafted extension. Once loaded, the extension issues calls into the vulnerable API surface and reads sensitive data such as browser state, other extensions' data, or user information exposed via the missing check. The vulnerability is not known to be exploited in the wild and is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified public proof-of-concept code is available. Technical detail is limited to the Chromium tracker entry, which references internal reproduction steps. See the Chromium Issue Tracker #523313374 for restricted technical details.

Detection Methods for CVE-2026-87431

Indicators of Compromise

Chrome browser reporting a version string earlier than 153.0.8010.36 in chrome://version
Newly installed or recently updated extensions from outside the Chrome Web Store
Extensions requesting broad permissions such as <all_urls>, tabs, storage, or cookies without a clear functional need
Outbound HTTPS connections from browser processes to unfamiliar domains shortly after extension installation

Detection Strategies

Inventory installed Chrome extensions across managed endpoints and compare identifiers against approved allowlists
Query endpoint telemetry for Chrome process versions and flag hosts running builds earlier than 153.0.8010.36
Correlate extension installation events with subsequent network egress to detect data exfiltration patterns
Review Chrome enterprise reporting logs for ExtensionInstalled and ExtensionUpdated events tied to unmanaged sources

Monitoring Recommendations

Enable Chrome Enterprise reporting to centralize extension inventory and version telemetry
Alert on Chrome process file writes to profile directories such as Extensions\ and Local Extension Settings\
Monitor DNS and proxy logs for anomalous browser-originated requests following extension changes
Track EPSS movement for CVE-2026-87431 as public exploit research evolves

How to Mitigate CVE-2026-87431

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints
Restart Chrome after the update to ensure the patched binary is loaded into memory
Audit currently installed extensions and remove any that are unused, unsigned, or unvetted
Restrict extension installation to the Chrome Web Store using enterprise policy

Patch Information

Google released the fix in the Chrome Stable channel update announced in the Google Chrome Desktop Update advisory. Administrators should confirm deployment by verifying that endpoints report Chrome version 153.0.8010.36 or higher. Automatic updates address the issue for consumer installations once the browser is restarted.

Workarounds

Apply the ExtensionInstallAllowlist policy to permit only vetted extension IDs
Set ExtensionInstallBlocklist to * and allowlist required extensions explicitly
Disable developer mode extensions using the DeveloperToolsAvailability policy on managed devices
Instruct users to remove any recently installed extensions of unknown origin until patching is complete

bash

# Configuration example: Chrome enterprise policy (Windows registry) to restrict extensions
reg add "HKLM\Software\Policies\Google\Chrome\ExtensionInstallBlocklist" /v 1 /t REG_SZ /d "*" /f
reg add "HKLM\Software\Policies\Google\Chrome\ExtensionInstallAllowlist" /v 1 /t REG_SZ /d "<approved-extension-id>" /f
reg add "HKLM\Software\Policies\Google\Chrome" /v DeveloperToolsAvailability /t REG_DWORD /d 2 /f