CVE-2026-87441: Google Chrome Authorization Bypass Vulnerability

CVE-2026-87441 Overview

CVE-2026-87441 is a missing authorization vulnerability [CWE-862] in the Downloads component of Google Chrome. Versions prior to 153.0.8010.36 allow a remote attacker to bypass system access restrictions using a crafted Chrome extension. The Chromium project rates the security severity as Medium. Exploitation requires user interaction to install the malicious extension, after which the attacker can trigger downloads or file operations that should have been blocked by browser-enforced access controls.

Critical Impact
A crafted Chrome extension can bypass Downloads authorization checks, enabling unauthorized file operations on affected systems running Chrome versions earlier than 153.0.8010.36.

Affected Products

Google Chrome desktop versions prior to 153.0.8010.36
Chromium-based browsers that inherit the vulnerable Downloads component
Chrome extension runtime environments across Windows, macOS, and Linux

Discovery Timeline

2026-09-09 - CVE-2026-87441 published to the National Vulnerability Database (NVD)
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87441

Vulnerability Analysis

The flaw resides in Chrome's Downloads subsystem, which fails to enforce required authorization checks before executing extension-initiated download operations. A malicious extension can invoke download APIs to write files to locations or trigger workflows that should require additional user consent or permission validation. Because the check is missing rather than merely weak, the extension bypasses restrictions entirely once loaded into the browser.

The vulnerability affects the integrity of the host system rather than the confidentiality of user data. An attacker leveraging this issue can drop files or manipulate download destinations to influence subsequent user actions. See the Chromium Issue Tracker Entry for upstream tracking.

Root Cause

The root cause is a missing authorization control [CWE-862] in the Downloads code path. Chrome's extension permission model normally gates sensitive file operations, but the affected code path executes without validating that the calling extension holds the required permission scope. This design gap allows any extension able to reach the download interface to perform actions beyond its documented capability set.

Attack Vector

Exploitation requires an attacker to convince a user to install a crafted Chrome extension. Once installed, the extension calls the Downloads API in a way that bypasses the intended access restrictions. The attack does not require prior authentication to Chrome or elevated privileges on the host. Delivery typically occurs through social engineering, sideloaded extension packages, or compromised extensions distributed through third-party channels.

No public proof-of-concept exploit is currently listed for CVE-2026-87441, and it is not tracked in the CISA Known Exploited Vulnerabilities catalog. Refer to the Google Chrome Stable Update advisory for vendor detail.

Detection Methods for CVE-2026-87441

Indicators of Compromise

Chrome extension installations from outside the official Chrome Web Store, especially those requesting the downloads permission
Unexpected files appearing in user download directories without corresponding user-initiated download actions
Browser telemetry showing extension IDs invoking chrome.downloads APIs at abnormal frequency

Detection Strategies

Inventory installed browser extensions across the fleet and compare against an allowlist maintained by IT or security teams
Monitor for Chrome process versions earlier than 153.0.8010.36 reporting from managed endpoints
Correlate file creation events in download directories with parent process metadata to identify extension-driven writes

Monitoring Recommendations

Ingest browser and endpoint file-write telemetry into a central data lake for cross-correlation with extension install events
Alert on new extension installations that request broad permissions such as downloads, tabs, or <all_urls>
Track Chrome update compliance through enterprise management tooling to identify hosts lagging on the patched build

How to Mitigate CVE-2026-87441

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints
Audit installed extensions and remove any that were sideloaded or sourced outside the Chrome Web Store
Enforce enterprise extension allowlists through Chrome Browser Cloud Management or group policy

Patch Information

Google released the fix in the Chrome Stable channel at version 153.0.8010.36. Details are documented in the Google Chrome Stable Update release notes. Administrators managing Chromium-derived browsers should confirm their vendor has integrated the corresponding upstream patch.

Workarounds

Restrict extension installation to an approved allowlist using the ExtensionInstallAllowlist and ExtensionInstallBlocklist policies
Disable developer mode for extensions on managed devices to prevent sideloading
Apply the ExtensionSettings policy to block extensions that request the downloads permission unless explicitly required

bash

# Example Chrome enterprise policy (Windows registry) blocking unapproved extensions
reg add "HKLM\Software\Policies\Google\Chrome\ExtensionInstallBlocklist" /v 1 /t REG_SZ /d "*" /f
reg add "HKLM\Software\Policies\Google\Chrome\ExtensionInstallAllowlist" /v 1 /t REG_SZ /d "<approved-extension-id>" /f
reg add "HKLM\Software\Policies\Google\Chrome\DeveloperToolsAvailability" /v DeveloperToolsAvailability /t REG_DWORD /d 2 /f