CVE-2026-87434: Google Chrome CORS Authorization Bypass

CVE-2026-87434 Overview

CVE-2026-87434 is a missing authorization vulnerability in the Cross-Origin Resource Sharing (CORS) implementation of Google Chrome prior to version 153.0.8010.36. A remote attacker who has already compromised the renderer process can bypass the web origin policy through a crafted HTML page. The flaw is tracked under [CWE-862: Missing Authorization] and is categorized by Chromium as Medium severity. Successful exploitation lets an attacker access resources from origins that CORS should have isolated, expanding the impact of an existing renderer compromise.

Critical Impact
Renderer-compromised attackers can bypass same-origin protections and reach cross-origin data that CORS is designed to gate.

Affected Products

Google Chrome versions prior to 153.0.8010.36
Chromium-based browsers sharing the same CORS enforcement code
Desktop Stable channel builds released before the September 2026 update

Discovery Timeline

2026-09-09 - CVE-2026-87434 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87434

Vulnerability Analysis

The vulnerability resides in Chrome's enforcement of CORS, the mechanism that governs whether a document loaded from one origin may access resources from another. Chrome's browser process is expected to authoritatively check origin-based access decisions rather than trusting the sandboxed renderer. Chromium's advisory describes the defect as a missing authorization check reachable when the renderer process is already compromised.

With the check absent, a hostile renderer can request cross-origin responses that the browser process should have refused. The attack requires user interaction and a crafted HTML page, and confidentiality of cross-origin data is the primary property at risk. Integrity and availability are not directly affected. Additional technical detail is tracked in Chromium Issue Tracker #493322521.

Root Cause

The root cause is an omitted authorization check in the CORS enforcement path. Chrome's security model treats the renderer as untrusted, so authorization decisions on cross-origin fetches must be made in the browser process. The missing check permits a compromised renderer to escape that boundary and reach data governed by the web origin policy.

Attack Vector

Exploitation is network-based but requires the attacker to have already compromised the renderer, typically by chaining a prior renderer-side flaw. The attacker then serves a crafted HTML page that issues cross-origin requests the browser should block. User interaction, such as visiting an attacker-controlled page, is required. No credentials or elevated privileges are needed on the target system.

No public proof-of-concept code is available. See the Google Chrome Stable Update for vendor detail.

Detection Methods for CVE-2026-87434

Indicators of Compromise

Chrome desktop instances reporting a version string below 153.0.8010.36 in browser telemetry or User-Agent logs.
Web server logs showing unexpected cross-origin fetch or XMLHttpRequest activity originating from browser sessions without matching Origin allowlists.
Endpoint alerts for prior renderer exploitation, which is a prerequisite for abusing this CORS bypass.

Detection Strategies

Inventory installed Chrome versions across the fleet and flag hosts below 153.0.8010.36.
Correlate browser process anomalies (unexpected child processes, sandbox escape indicators) with subsequent cross-origin network activity.
Monitor web application logs for Origin headers that do not match expected client populations, particularly for authenticated endpoints.

Monitoring Recommendations

Ingest browser and endpoint telemetry into a central data lake to correlate renderer exploitation with follow-on cross-origin requests.
Track Chrome update compliance as a continuous metric and alert on stalled deployments.
Watch for exploit chains that pair a renderer RCE with authorization bypass primitives, since CVE-2026-87434 requires a compromised renderer as its precondition.

How to Mitigate CVE-2026-87434

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints.
Force browser restarts after deployment so the patched binary is loaded into active user sessions.
Audit third-party Chromium-based browsers and apply their corresponding upstream fix.

Patch Information

Google released the fix in the Stable channel update announced on September 2026. Details are available in the Google Chrome Stable Update release notes. Administrators should validate that clients report a version greater than or equal to 153.0.8010.36 via chrome://version or enterprise management telemetry.

Workarounds

No vendor-supplied workaround exists; patching is the supported remediation.
Reduce exposure by restricting browsing to trusted sites through enterprise browser policy until updates are deployed.
Enforce site isolation and disable unnecessary browser extensions that broaden the renderer attack surface.

bash

# Verify Chrome version on Windows endpoints
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Verify Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Verify Chrome version on Linux
google-chrome --version