CVE-2026-87442: Google Chrome Prerender Auth Bypass Flaw

CVE-2026-87442 Overview

CVE-2026-87442 is a confused deputy vulnerability in the Prerender component of Google Chrome versions prior to 153.0.8010.36. A remote attacker who has already compromised the renderer process can use a crafted HTML page to bypass web origin policy. Chromium rates the security severity as Medium, while the National Vulnerability Database assigns a Low severity rating. The flaw is tracked under [CWE-441] (Unintended Proxy or Intermediary). Successful exploitation requires user interaction and depends on prior renderer compromise, which raises the attack complexity.

Critical Impact
A compromised renderer process can leverage Prerender to act on resources across origins, breaking the same-origin policy that isolates web content in Chrome.

Affected Products

Google Chrome Desktop versions prior to 153.0.8010.36
Chromium-based browsers incorporating the vulnerable Prerender component
Downstream Chromium redistributions built before the September 2026 stable channel update

Discovery Timeline

2026-09-09 - CVE-2026-87442 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87442

Vulnerability Analysis

The vulnerability resides in Chrome's Prerender subsystem, which speculatively loads pages a user is likely to navigate to next. Prerender operates with permissions that span multiple origins because it prepares resources on behalf of the browser process. When the renderer supplies input that Prerender trusts without adequate origin validation, the component performs privileged actions on the attacker's behalf. This pattern matches the confused deputy category described in [CWE-441], where a privileged intermediary is tricked into misusing its authority.

Exploitation is not straightforward. The attacker must first compromise the renderer process through a separate vulnerability. The attacker then delivers a crafted HTML page that manipulates Prerender's cross-origin handling. User interaction is required to trigger the prerender flow.

Root Cause

The root cause is insufficient enforcement of web origin boundaries within Prerender when handling requests originating from the renderer. Prerender treats renderer-supplied navigation targets as authoritative rather than validating them against the initiating origin. A compromised renderer can therefore direct Prerender to fetch and process resources under a different origin's authority.

Attack Vector

The attack chain begins with renderer process compromise, typically achieved through a separate memory corruption or logic bug. The attacker hosts a crafted HTML page that issues Prerender directives designed to cross origin boundaries. When the victim's compromised renderer processes the page, Prerender executes cross-origin operations that the same-origin policy would normally block. This can enable disclosure of low-sensitivity data from other origins. See the Chromium Issue Tracker #497443419 for technical detail.

No verified public proof-of-concept code is available for this issue.

Detection Methods for CVE-2026-87442

Indicators of Compromise

Chrome or Chromium-based browser processes running versions below 153.0.8010.36 in enterprise inventory
Unexpected cross-origin resource fetches initiated by prerender navigation entries in browser telemetry
Renderer process crashes or sandbox anomalies preceding suspicious network activity to unrelated origins

Detection Strategies

Inventory installed browser versions across managed endpoints and flag Chrome builds prior to 153.0.8010.36
Correlate renderer crash telemetry with subsequent outbound requests to identify potential exploit chains
Monitor for HTML content that programmatically triggers <link rel="prerender"> or Speculation Rules API entries pointing to unrelated origins

Monitoring Recommendations

Ingest Chrome enterprise reporting and browser process telemetry into a centralized analytics platform for version and crash analysis
Track outbound web traffic patterns for anomalies consistent with speculative cross-origin fetches
Alert on endpoints running unpatched Chrome builds after the vendor patch date

How to Mitigate CVE-2026-87442

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints
Verify Chromium-based browsers such as Microsoft Edge, Brave, and Opera have integrated the corresponding Chromium security fix
Prioritize patching for users who browse untrusted content or handle sensitive cross-origin data

Patch Information

Google released the fix in the Chrome Stable channel update documented in the Google Chrome Stable Update. Users on managed installations should confirm automatic update policies are enforced. Enterprise administrators can push the update via Chrome Browser Enterprise policies.

Workarounds

Disable prerendering through the NetworkPredictionOptions enterprise policy where update deployment is delayed
Restrict browsing on high-risk endpoints to trusted origins until patching completes
Enforce site isolation and strict sandbox policies to raise the difficulty of the prerequisite renderer compromise

bash

# Chrome enterprise policy to disable network prediction (workaround)
# Windows registry example
reg add "HKLM\Software\Policies\Google\Chrome" /v NetworkPredictionOptions /t REG_DWORD /d 2 /f