CVE-2026-87443: Google Chrome Information Disclosure Flaw

CVE-2026-87443 Overview

CVE-2026-87443 is a missing authorization vulnerability in the Actor component of Google Chrome prior to version 153.0.8010.36. A remote attacker can obtain sensitive information by tricking a user into visiting a crafted HTML page. The flaw is classified under CWE-862: Missing Authorization and carries a Chromium security severity rating of Medium.

Successful exploitation exposes sensitive browser data to attacker-controlled web content. Exploitation requires user interaction, specifically loading the malicious page in a vulnerable Chrome build.

Critical Impact
A remote attacker can retrieve sensitive information from the browser context by serving a crafted HTML page to a user running Chrome before 153.0.8010.36.

Affected Products

Google Chrome Desktop (Windows, macOS, Linux) versions prior to 153.0.8010.36
Chromium-based browsers that inherit the vulnerable Actor component
Downstream distributions that had not merged the fix at the time of publication

Discovery Timeline

2026-09-09 - CVE CVE-2026-87443 published to NVD
2026-09-09 - Last updated in NVD database
2026-09-09 - Google publishes Chrome Stable Channel Update for Desktop addressing the issue (Chrome Releases)

Technical Details for CVE-2026-87443

Vulnerability Analysis

The vulnerability resides in the Actor component of Google Chrome. Actor handles automated or agentic browser actions on behalf of the user. The affected code path performs an operation without validating that the caller is authorized to access the requested resource. As a result, web content loaded in the browser can invoke functionality intended for privileged or user-authorized contexts.

Because the flaw is a missing authorization check rather than a memory-safety issue, exploitation does not require complex payload construction. An attacker only needs to reach the unprotected code path through standard web APIs served from a crafted HTML page. The impact is confined to confidentiality; integrity and availability are not directly affected, according to the published CVSS vector.

Root Cause

The root cause is a missing authorization check [CWE-862] within the Actor component. The code path that returns sensitive information does not confirm that the requesting origin or context holds the required permission. This design gap allows any origin capable of loading in the browser to reach the protected operation.

Attack Vector

Exploitation occurs over the network and requires user interaction. The user must visit a page controlled by the attacker or one that has been compromised to serve the crafted HTML. No credentials are required on the target system, and no additional privileges are needed on the client. Once the page loads, the attacker's script exercises the unauthenticated Actor code path and exfiltrates the returned data to a remote endpoint.

Detailed technical information is tracked in Chromium Issue #502768228. No public proof-of-concept exploit is available at the time of writing, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-87443

Indicators of Compromise

Chrome browser process versions reporting below 153.0.8010.36 in endpoint inventory data
Outbound HTTPS connections from browser processes to unfamiliar domains immediately after visiting untrusted sites
Unexpected renderer process activity accessing Actor-related IPC channels or storage APIs

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build older than 153.0.8010.36.
Correlate web proxy logs with browser telemetry to identify visits to pages that trigger anomalous data-egress patterns.
Hunt for suspicious script activity in browser extensions or automation frameworks that interact with Chrome's Actor interfaces.

Monitoring Recommendations

Ingest browser version telemetry into your security data lake and alert on drift from the patched baseline.
Monitor DNS and TLS metadata for beaconing patterns from chrome.exe or its equivalents on macOS and Linux.
Track user-reported anomalies such as unsolicited prompts, unexpected downloads, or session data appearing on unknown services.

How to Mitigate CVE-2026-87443

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints.
Force-restart Chrome after the update to ensure the patched binaries load into memory.
Verify that Chromium-based browsers used in the environment have merged the fix from upstream.

Patch Information

Google released the fix in the Chrome Stable Channel Update for Desktop referenced in the Chrome Releases advisory. Administrators should confirm that automatic updates are enabled and that the deployed version reports 153.0.8010.36 or higher. Enterprise deployments using Chrome Browser Cloud Management or Group Policy should push the update through their existing channels.

Workarounds

Restrict user browsing to trusted sites through web filtering while the patch is being deployed.
Disable or restrict Chrome's Actor or agentic browsing features via enterprise policy if the environment permits.
Educate users to avoid clicking untrusted links until endpoints report the patched version.

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Windows: query the installed version from the registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# macOS: read the CFBundleShortVersionString from the app bundle
defaults read "/Applications/Google Chrome.app/Contents/Info" CFBundleShortVersionString