CVE-2026-87437: Google Chrome Information Disclosure Flaw

CVE-2026-87437 Overview

CVE-2026-87437 is an information disclosure vulnerability in the Frames component of Google Chrome prior to version 153.0.8010.36. A remote attacker can leak sensitive information by convincing a user to load a crafted HTML page. The flaw is categorized under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Google's internal Chromium severity assessment for the issue is Low, though the NVD CVSS scoring reflects higher confidentiality impact due to the network attack vector.

Critical Impact
A remote attacker can exfiltrate sensitive cross-context data from the browser by luring a user to a malicious webpage, bypassing intended frame isolation boundaries.

Affected Products

Google Chrome versions prior to 153.0.8010.36 (Stable channel, Desktop)
Chromium-based browsers incorporating the vulnerable Frames component
All supported desktop platforms (Windows, macOS, Linux) running affected builds

Discovery Timeline

2026-09-09 - CVE-2026-87437 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87437

Vulnerability Analysis

The vulnerability resides in the Frames subsystem of Google Chrome. Frames handle the loading, rendering, and isolation of embedded browsing contexts such as <iframe> elements. An information leak in this component means data intended to be protected by the same-origin policy or cross-origin isolation guarantees can be observed by an attacker-controlled context.

Exploitation requires user interaction. The victim must visit or be redirected to a page hosting attacker-controlled HTML. Once loaded, the crafted content triggers the leak against another frame or resource accessible to the browser session. Because the attack executes fully in the browser, no additional privileges or credentials are required on the target host.

The leaked information can include cross-origin content, navigation state, or other data that the browser's frame boundaries should keep separated. Attackers commonly chain such leaks with phishing, session reconnaissance, or targeted intelligence collection.

Root Cause

The root cause is improper enforcement of information boundaries between frames, consistent with CWE-200. The specific implementation defect is not disclosed in the public advisory. See the Chromium Issue Tracker entry #540082621 for restricted technical details once access is granted.

Attack Vector

Delivery occurs over the network through any channel that renders untrusted HTML in Chrome: a compromised website, a malicious advertisement, a phishing link, or an embedded frame on an otherwise legitimate site. The attacker crafts an HTML page that manipulates frame behavior to observe data outside the attacker's origin. Since no authentication is required and the interaction is limited to visiting a page, mass-exploitation via drive-by content is feasible.

No public proof-of-concept exploit code is available. Refer to the Google Chrome Stable Update advisory for vendor guidance.

Detection Methods for CVE-2026-87437

Indicators of Compromise

Chrome browser processes running versions earlier than 153.0.8010.36 after the patch release date
User navigation to unknown or newly registered domains hosting heavily obfuscated HTML with unusual iframe nesting
Outbound requests from browser processes carrying encoded payloads that correlate with recent visits to untrusted sites

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build below 153.0.8010.36
Correlate browser telemetry with proxy or DNS logs to identify sessions where users visited suspicious pages containing cross-origin frame constructs
Monitor for anomalous data volumes leaving browser processes to previously unseen domains

Monitoring Recommendations

Enable browser management telemetry through Chrome Enterprise policies to report version and extension state centrally
Ingest endpoint browser process telemetry and web proxy logs into a centralized analytics platform for cross-source correlation
Track EPSS movement for CVE-2026-87437; the current EPSS probability is 0.291%, but public exploit availability can shift risk quickly

How to Mitigate CVE-2026-87437

Immediate Actions Required

Update all instances of Google Chrome to version 153.0.8010.36 or later on Windows, macOS, and Linux endpoints
Force-restart Chrome after the update to ensure the patched binary is loaded, since Chrome applies updates only on relaunch
Audit Chromium-derived browsers (Edge, Brave, Opera, Vivaldi) and apply the corresponding upstream fix once vendors release it

Patch Information

Google addressed the vulnerability in the Chrome Stable channel update to 153.0.8010.36. Deployment details are published in the Google Chrome Stable Update announcement. Enterprises should distribute the update through Chrome Browser Cloud Management, Group Policy, MDM, or their standard software distribution tooling.

Workarounds

Restrict browsing to trusted sites through enterprise web filtering until patches are fully deployed
Enable strict site isolation and cross-origin opener policies through Chrome Enterprise policies to reduce cross-context data exposure
Advise users to avoid clicking untrusted links and to close browser sessions after handling sensitive content until the update is applied

bash

# Verify installed Chrome version on Linux
google-chrome --version

# Verify on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Windows: check via registry
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Enterprise policy example (JSON) to enforce automatic updates and site isolation
# Place in Chrome managed policies location for your OS
{
  "SitePerProcess": true,
  "IsolateOrigins": "https://*.example.com",
  "ComponentUpdatesEnabled": true,
  "DefaultBrowserSettingEnabled": true
}