Skip to main content
OneCon26: Gain the advantage in the AI era. Oct. 20–22 in Las Vegas.Register Now
Vulnerability Database/CVE-2026-87435

CVE-2026-87435: Google Chrome Information Disclosure Flaw

CVE-2026-87435 is an information disclosure vulnerability in Google Chrome ControlledFrame that enables attackers to access sensitive data through compromised renderer processes. This article covers technical details, affected versions, security impact, and mitigation strategies.

Published:

CVE-2026-87435 Overview

CVE-2026-87435 is an information disclosure vulnerability in the ControlledFrame component of Google Chrome. Versions prior to 153.0.8010.36 are affected. A remote attacker who has already compromised the renderer process can obtain sensitive information by serving a crafted HTML page to the victim. The Chromium project classifies the issue as Medium severity, and it maps to CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact

An attacker with an already-compromised renderer can leak sensitive in-process data through a crafted page loaded in ControlledFrame, weakening the browser sandbox boundary and enabling follow-on attacks.

Affected Products

  • Google Chrome (Desktop) versions prior to 153.0.8010.36
  • Chromium-based browsers embedding the vulnerable ControlledFrame code
  • Applications using the Chromium <controlledframe> element on Isolated Web Apps

Discovery Timeline

Technical Details for CVE-2026-87435

Vulnerability Analysis

The flaw resides in ControlledFrame, the Chromium element that allows Isolated Web Apps to embed and control third-party web content, similar to the legacy <webview> tag. The component leaks sensitive information back to script running in a compromised renderer process. Exploitation requires the attacker to have already achieved code execution inside the renderer sandbox and to convince the user to load a crafted HTML page. The leaked data can then be used to escalate the impact of an existing compromise or to bypass mitigations that rely on process isolation.

Root Cause

The root cause is classified as CWE-200: Information Exposure within the ControlledFrame implementation. State that should remain isolated from web-exposed script paths is instead reachable from a crafted page. The upstream fix is tracked in Chromium Issue #533070113, which is currently restricted per Chromium disclosure policy while users update.

Attack Vector

The attack is network-reachable but requires two preconditions. First, the attacker must have compromised the renderer process, typically through a separate vulnerability. Second, the victim must interact with attacker-controlled content by loading a crafted HTML page. When both conditions are met, script inside the compromised renderer queries ControlledFrame APIs and receives data that should not be exposed to web content.

No public proof-of-concept or exploit code is available for CVE-2026-87435 at the time of publication. A prose description of the mechanism is provided above; refer to the Chromium security advisory for further technical detail once the upstream bug is opened.

Detection Methods for CVE-2026-87435

Indicators of Compromise

  • Chrome browser processes running versions earlier than 153.0.8010.36 after the patch release date
  • Isolated Web Apps or enterprise applications instantiating <controlledframe> elements that load untrusted third-party origins
  • Renderer process crashes, unexpected navigations, or anomalous IPC traffic preceding sensitive data access

Detection Strategies

  • Inventory installed Chrome versions across managed endpoints and flag any host below 153.0.8010.36
  • Correlate browser child-process telemetry with subsequent outbound connections to newly registered or low-reputation domains
  • Alert on Isolated Web Apps loading crafted HTML from origins not on an approved allowlist

Monitoring Recommendations

  • Ingest Chrome update and version telemetry into your SIEM to track patch compliance over time
  • Monitor endpoint process trees for suspicious child processes spawned from chrome.exe renderer instances
  • Track user-agent and version strings in web proxy logs to identify out-of-date browsers reaching the internet

How to Mitigate CVE-2026-87435

Immediate Actions Required

  • Update Google Chrome to version 153.0.8010.36 or later on all Windows, macOS, and Linux endpoints
  • Force a browser relaunch through enterprise management tooling to ensure the patched binary is active
  • Audit any internal Isolated Web Apps that use <controlledframe> and restrict embedded origins to trusted content

Patch Information

Google addressed CVE-2026-87435 in the Chrome Stable channel release 153.0.8010.36. See the Chrome Stable Channel Update for Desktop for the full advisory and the Chromium Issue Tracker entry #533070113 for the upstream bug reference. Chromium-based browsers such as Microsoft Edge, Brave, and Opera should be updated once their vendors ship the corresponding Chromium merge.

Workarounds

  • Disable or restrict use of Isolated Web Apps that embed untrusted third-party content via ControlledFrame until patched
  • Enforce Chrome auto-update through group policy or MDM to shorten the exposure window on unmanaged devices
  • Apply web content filtering to block navigation to untrusted origins from managed browser fleets
bash
# Enforce Chrome auto-update on Windows via Group Policy registry keys
reg add "HKLM\Software\Policies\Google\Update" /v UpdateDefault /t REG_DWORD /d 1 /f
reg add "HKLM\Software\Policies\Google\Update" /v AutoUpdateCheckPeriodMinutes /t REG_DWORD /d 60 /f

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.

Experience the Most Advanced Cybersecurity Platform

See how the world’s most intelligent, autonomous cybersecurity platform can protect your organization today and into the future.

Try SentinelOne