CVE-2026-87446: Google Chrome Extension Auth Bypass Flaw

CVE-2026-87446 Overview

CVE-2026-87446 is an incomplete cleanup vulnerability [CWE-459] in the Extensions component of Google Chrome prior to version 153.0.8010.36. A remote attacker who convinces a user to install a crafted Chrome extension can bypass system access restrictions. The Chromium project rated the security severity as Medium. Exploitation requires user interaction, specifically social engineering to trick the victim into installing the malicious extension. Once installed, the extension leverages residual state left behind by incomplete cleanup routines to circumvent access boundaries that would otherwise contain extension activity.

Critical Impact
A crafted Chrome extension can bypass system access restrictions on unpatched browsers, allowing an attacker to affect integrity of protected resources through incomplete cleanup logic in the Extensions subsystem.

Affected Products

Google Chrome versions prior to 153.0.8010.36
Chromium-based browsers incorporating the vulnerable Extensions component
Desktop Chrome Stable channel installations

Discovery Timeline

2026-09-09 - CVE-2026-87446 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87446

Vulnerability Analysis

The vulnerability resides in the Extensions subsystem of Google Chrome. Chrome enforces system access restrictions that limit what extensions can read, write, or invoke on the host. The cleanup routines associated with extension state fail to fully remove or reset resources between operations. This residual state allows a crafted extension to reach system resources that access-restriction logic would normally block. The result is an integrity impact against the host, without requiring elevated privileges on the browser side.

The issue is classified under CWE-459: Incomplete Cleanup. Attacks are delivered over the network through extension distribution channels, but successful exploitation depends on convincing the user to install the malicious extension.

Root Cause

The root cause is that the Extensions component does not fully release or sanitize internal state during teardown or transition operations. Attackers reuse this leftover state to interact with resources that should be gated by Chrome's access restrictions. Full technical details are tracked in Chromium Issue #483435192.

Attack Vector

Exploitation follows a social engineering pattern. The attacker publishes or delivers a crafted Chrome extension and induces the user to install it, for example through a phishing page, sideloading instructions, or a compromised distribution channel. Once loaded in a vulnerable Chrome build, the extension triggers the cleanup gap to bypass system access restrictions. No authentication is required and the attack complexity is low, but user interaction is mandatory.

No public proof-of-concept or exploit code has been released for CVE-2026-87446 at the time of publication. See the Google Chrome Stable Update for vendor context.

Detection Methods for CVE-2026-87446

Indicators of Compromise

Installation of Chrome extensions from outside the Chrome Web Store or from newly registered publishers.
Chrome processes accessing files, registry keys, or system resources that fall outside typical extension sandboxing behavior.
Extension IDs that appear in the Extensions directory of a user profile without a corresponding administrative or user-initiated install event.

Detection Strategies

Inventory installed Chrome extensions across managed endpoints and compare against an allowlist.
Monitor Chrome browser versions and flag any host running a build earlier than 153.0.8010.36.
Alert on process trees where chrome.exe or renderer subprocesses spawn unexpected child processes or perform sensitive file system operations.

Monitoring Recommendations

Ingest browser telemetry, including extension install and load events, into a centralized analytics platform.
Correlate extension activity with outbound network connections to identify command-and-control patterns tied to malicious extensions.
Track user-reported prompts to install unfamiliar extensions as an early indicator of social engineering campaigns.

How to Mitigate CVE-2026-87446

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints.
Force a browser restart after update deployment to ensure the patched binaries are loaded.
Audit all currently installed extensions and remove any that are unsanctioned, unsigned, or from unknown publishers.

Patch Information

Google addressed CVE-2026-87446 in Chrome Stable 153.0.8010.36. Refer to the Google Chrome Stable Update announcement for the full advisory and to Chromium Issue #483435192 for tracking details. Chromium-based browsers should incorporate the equivalent upstream fix before being considered patched.

Workarounds

Enforce Chrome enterprise policies such as ExtensionInstallAllowlist and ExtensionInstallBlocklist to restrict which extensions users can install.
Disable developer mode and block sideloading of unpacked extensions on managed devices.
Deliver user awareness guidance that warns against installing extensions promoted through unsolicited links, pop-ups, or downloads.

bash

# Example Chrome enterprise policy to restrict extensions (Windows registry)
reg add "HKLM\Software\Policies\Google\Chrome\ExtensionInstallAllowlist" /v 1 /t REG_SZ /d "<approved-extension-id>" /f
reg add "HKLM\Software\Policies\Google\Chrome" /v ExtensionInstallBlocklist /t REG_SZ /d "*" /f