CVE-2026-87432: Google Chrome Auth Bypass Vulnerability

CVE-2026-87432 Overview

CVE-2026-87432 is an incorrect authorization vulnerability in the Navigation component of Google Chrome prior to version 153.0.8010.36. An attacker who has already compromised the renderer process can spoof user interface (UI) elements by delivering a crafted HTML page. Chromium classifies the issue as Medium severity and tracks it under CWE-863: Incorrect Authorization.

The flaw does not, on its own, grant code execution. It functions as a secondary exploitation primitive that supports phishing, security indicator spoofing, and social engineering after an initial compromise of the renderer sandbox.

Critical Impact
Attackers with a compromised renderer process can spoof browser UI elements, enabling convincing phishing and security indicator forgery against Chrome users on versions before 153.0.8010.36.

Affected Products

Google Chrome versions prior to 153.0.8010.36
Chromium-based browsers that inherit the vulnerable Navigation code
Desktop Stable channel builds addressed in the referenced Chrome release

Discovery Timeline

2026-09-09 - CVE-2026-87432 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database
2026-09-09 - Google publishes the Stable Channel Update for Desktop addressing the issue

Technical Details for CVE-2026-87432

Vulnerability Analysis

The vulnerability resides in Chrome's Navigation component, which enforces authorization decisions between the renderer and browser processes. Chrome's multi-process architecture relies on the browser process to validate navigation-related requests originating from renderer processes.

When the renderer is compromised, an attacker gains the ability to send arbitrary navigation-related messages to the browser process. Because authorization is applied incorrectly in this path, the browser accepts requests that should have been rejected. The result is that attacker-controlled content can influence UI elements the user relies on to make trust decisions.

Exploitation requires user interaction and a compromised renderer, which raises attack complexity. The confidentiality and availability impact is limited, and there is no direct integrity impact on user data. The practical outcome is UI spoofing rather than data theft or code execution.

Root Cause

The root cause is an incorrect authorization check (CWE-863) within the Navigation logic. The browser process trusts navigation state or origin data supplied by a renderer without fully validating that the renderer is authorized to assert it. This breaks the security boundary between renderer and browser processes.

Attack Vector

Exploitation requires two conditions. First, the attacker must compromise the renderer process, typically through a separate memory corruption or logic bug. Second, the attacker delivers a crafted HTML page that triggers the malformed navigation flow.

Once the malformed navigation is accepted, the attacker can manipulate UI surfaces such as the address bar, security indicators, or dialog framing. This enables high-fidelity phishing overlays against the user viewing the page. Public proof-of-concept code is not available at this time.

Detection Methods for CVE-2026-87432

Indicators of Compromise

Chrome browser processes running versions earlier than 153.0.8010.36 in enterprise inventories
Renderer process crashes or unexpected navigation events preceding user-reported phishing attempts
HTML pages that combine renderer exploitation payloads with navigation manipulation calls

Detection Strategies

Inventory browser versions across managed endpoints and flag Chrome builds below 153.0.8010.36
Correlate endpoint telemetry showing anomalous Chrome child process behavior with subsequent credential submission events
Hunt for outbound connections to phishing infrastructure originating from browser sessions that recently loaded untrusted content

Monitoring Recommendations

Ingest Chrome update and version telemetry into your SIEM to track patch compliance in real time
Monitor for renderer process anomalies, including unexpected child processes or memory tampering signals
Alert on user reports of address bar or security indicator inconsistencies, which can indicate UI spoofing attempts

How to Mitigate CVE-2026-87432

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints
Force restart of Chrome after update deployment to ensure the patched binary is loaded
Audit Chromium-based browsers in the environment and apply vendor updates that incorporate the upstream fix

Patch Information

Google addressed CVE-2026-87432 in the Chrome Stable channel release documented in the Stable Channel Update for Desktop. Technical tracking is available in Chromium Issue Tracker #511820041. Administrators should deploy 153.0.8010.36 or a later build through their standard software distribution channels.

Workarounds

Enforce automatic Chrome updates via enterprise policy to reduce exposure windows
Restrict browsing to trusted sites through URL filtering while patch rollout is in progress
Educate users to be skeptical of unexpected credential prompts or security warnings within the browser

bash

# Configuration example: verify installed Chrome version on Windows and Linux
# Windows (PowerShell)
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# Linux
google-chrome --version

# Expected minimum patched version:
# 153.0.8010.36