CVE-2026-87436: Google Chrome Auth Bypass Vulnerability

CVE-2026-87436 Overview

CVE-2026-87436 is an incomplete cleanup vulnerability [CWE-459] in the Browser component of Google Chrome prior to version 153.0.8010.36. A remote attacker who convinces a user to install a crafted Chrome extension can bypass the web origin policy. The Chromium project rated the security severity as Medium. Exploitation requires social engineering because the attacker must persuade the target to install a malicious extension. Once installed, the extension can leverage residual state left by incomplete cleanup routines to read or act on content across web origins the extension should not reach.

Critical Impact
Successful exploitation allows a malicious Chrome extension to bypass the same-origin protections that isolate web content, enabling cross-origin data access from an installed extension context.

Affected Products

Google Chrome (Desktop) versions prior to 153.0.8010.36
Chromium-based browsers that share the affected Browser process cleanup logic
Chrome extensions ecosystem relying on origin isolation guarantees

Discovery Timeline

2026-09-09 - CVE-2026-87436 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87436

Vulnerability Analysis

The flaw resides in the Browser process of Google Chrome and is classified as an incomplete cleanup issue [CWE-459]. When Chrome tears down browser-side resources tied to a web origin, residual state persists after the cleanup path completes. A Chrome extension can observe or reuse this residual state to perform actions that the browser's web origin policy would normally prohibit.

Because the defect lives in the trusted Browser process rather than the renderer sandbox, the origin boundary enforced by the same-origin policy can be traversed without a renderer compromise. The Chromium project assigned the issue a Medium severity, reflecting that a user interaction step (installing a crafted extension) gates exploitation.

Public technical detail is limited. The Chromium bug tracker entry (Chromium Issue #511754574) remains restricted at the time of publication, consistent with Chrome's disclosure practice for recently patched issues.

Root Cause

The root cause is an incomplete cleanup routine in the Browser component. State associated with an origin is not fully released or invalidated at the correct point in the resource lifecycle, leaving reachable references that an extension can leverage after the logical boundary should have closed.

Attack Vector

Exploitation follows a social-engineering-first pattern. The attacker publishes or side-loads a crafted extension and convinces the user to install it. Once running with normal extension privileges, the extension triggers the browser code paths that expose the incompletely cleaned resources and reads or manipulates data belonging to an origin the extension is not authorized to touch. No memory corruption primitive is required.

No verified proof-of-concept code is publicly available. Refer to the Chrome Release Update for vendor context.

Detection Methods for CVE-2026-87436

Indicators of Compromise

Installation of unreviewed or side-loaded Chrome extensions from outside the enterprise-approved allowlist.
Extensions requesting broad host permissions (<all_urls>) or webRequest, cookies, and scripting scopes that do not match their stated function.
Chrome browser versions reporting a build below 153.0.8010.36 in managed inventory.

Detection Strategies

Inventory installed Chrome extensions across managed endpoints and compare against an approved list.
Alert on chrome.exe (or platform equivalent) processes running versions below 153.0.8010.36.
Monitor extension install events in enterprise Chrome policy telemetry and flag installations outside the Chrome Web Store or approved sources.

Monitoring Recommendations

Ingest Chrome enterprise reporting into a central data lake to track extension inventory and browser version drift.
Watch for anomalous outbound HTTP requests originating from browser processes shortly after new extension installations.
Correlate user-reported phishing or social-engineering attempts that reference browser extensions with subsequent extension installs.

How to Mitigate CVE-2026-87436

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all managed and unmanaged endpoints.
Audit currently installed extensions and remove any that are unnecessary, unsigned, or not sourced from a trusted publisher.
Enforce an extension allowlist through Chrome Enterprise policy to block installation of arbitrary extensions.

Patch Information

Google addressed the issue in the Chrome Stable channel starting at 153.0.8010.36. See the vendor announcement in the Chrome Release Update. Chromium-based browsers should be updated to a version that incorporates the corresponding upstream fix.

Workarounds

Block installation of non-approved extensions using ExtensionInstallBlocklist set to * combined with an explicit ExtensionInstallAllowlist.
Restrict extension sources to the Chrome Web Store and enterprise-published extensions only.
Deliver user awareness communications warning against installing browser extensions requested through unsolicited messages.

bash

# Chrome Enterprise policy example (Windows registry)
# Block all extensions by default, then allow only approved IDs
reg add "HKLM\Software\Policies\Google\Chrome\ExtensionInstallBlocklist" /v 1 /t REG_SZ /d "*" /f
reg add "HKLM\Software\Policies\Google\Chrome\ExtensionInstallAllowlist" /v 1 /t REG_SZ /d "<approved-extension-id>" /f

# Force minimum Chrome version through managed update channel
reg add "HKLM\Software\Policies\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v TargetVersionPrefix /t REG_SZ /d "153.0.8010.36" /f