CVE-2026-87447: Google Chrome Authorization Bypass Vulnerability

CVE-2026-87447 Overview

CVE-2026-87447 is an incorrect authorization vulnerability in the Network component of Google Chrome. The flaw affects Chrome versions prior to 153.0.8010.36 and allows a remote attacker to bypass the web origin policy through a crafted Chrome extension. Exploitation requires social engineering to convince a user to install the malicious extension. Chromium classified the security severity as High, while NVD assigned a CVSS 3.1 score reflecting integrity impact without confidentiality or availability effects. The weakness is tracked under CWE-863: Incorrect Authorization.

Critical Impact
Successful exploitation lets an attacker-controlled extension violate same-origin boundaries, enabling cross-origin data manipulation and unauthorized actions within the victim's browser session.

Affected Products

Google Chrome Desktop versions prior to 153.0.8010.36
Chromium-based browsers incorporating the vulnerable Network component
Chrome Stable channel builds preceding the September 2026 security update

Discovery Timeline

2026-09-09 - CVE-2026-87447 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87447

Vulnerability Analysis

The vulnerability resides in Chrome's Network stack, where authorization checks fail to correctly enforce the web origin policy for requests originating from browser extensions. The web origin policy is the foundational browser security boundary that isolates content from different sites. When this policy is bypassed, an extension gains the ability to read or modify data belonging to origins it should not access. Because the flaw sits in shared network handling logic, any page loaded by the victim during the attack window is potentially exposed.

Exploitation depends on user interaction, specifically installing a malicious extension delivered through social engineering. Once installed, the extension operates within the browser's trust boundary and abuses the authorization defect to reach cross-origin resources. The integrity impact is significant because the attacker can influence data the victim submits or receives from legitimate websites.

Root Cause

The root cause is an incorrect authorization check [CWE-863] in Chrome's Network component. The code path responsible for validating extension access against target origins accepts requests that should be denied under the same-origin model. Details of the exact function are limited to Google's private Chromium Issue Tracker #503464711 pending broader disclosure.

Attack Vector

The attack chain begins with a threat actor publishing or delivering a crafted Chrome extension. The victim is persuaded through phishing, deceptive advertising, or fake update prompts to install the extension. After installation, the extension issues network requests that exploit the authorization flaw to interact with origins outside its declared permissions, tampering with data or triggering unauthorized state changes in web applications the user is authenticated to.

No verified public exploit code is available for this vulnerability. The mechanism is described here in prose based on the vendor advisory. See the Google Chrome Stable Update for the official notice.

Detection Methods for CVE-2026-87447

Indicators of Compromise

Installation of unfamiliar Chrome extensions from outside the Chrome Web Store or from low-reputation publishers.
Extensions requesting broad host permissions such as <all_urls> combined with webRequest or declarativeNetRequest APIs.
Outbound HTTP requests from browser processes to attacker-controlled domains that correlate with active user sessions on sensitive applications.

Detection Strategies

Inventory installed Chrome extensions across managed endpoints and compare against an approved allowlist.
Alert on Chrome versions below 153.0.8010.36 reported by endpoint telemetry or browser management consoles.
Correlate extension installation events with subsequent anomalous network activity from chrome.exe or chrome processes.

Monitoring Recommendations

Enable Chrome Enterprise reporting to forward extension install and update events to central log storage.
Monitor Preferences and Secure Preferences files under the Chrome user data directory for unauthorized extension entries.
Track DNS and proxy logs for requests to newly registered domains referenced by recently installed extensions.

How to Mitigate CVE-2026-87447

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all Windows, macOS, and Linux endpoints.
Audit installed extensions and remove any that lack a clear business justification or come from untrusted publishers.
Deliver targeted user awareness communication warning against installing extensions from unsolicited links or prompts.

Patch Information

Google addressed CVE-2026-87447 in the Chrome Stable channel release 153.0.8010.36. Refer to the Google Chrome Stable Update announcement for full release notes. Chromium-based browser vendors including Microsoft Edge, Brave, Opera, and Vivaldi should be updated once they incorporate the upstream fix.

Workarounds

Enforce an extension allowlist through Chrome Enterprise policy using ExtensionInstallAllowlist and ExtensionInstallBlocklist.
Restrict extension installation to the Chrome Web Store and block sideloading via the ExtensionInstallSources policy.
Disable developer mode for extensions on managed devices to prevent unpacked extension loading.

bash

# Chrome Enterprise policy example (Windows registry)
# Block all extensions by default, then allow only approved IDs
reg add "HKLM\Software\Policies\Google\Chrome\ExtensionInstallBlocklist" /v 1 /t REG_SZ /d "*" /f
reg add "HKLM\Software\Policies\Google\Chrome\ExtensionInstallAllowlist" /v 1 /t REG_SZ /d "<approved-extension-id>" /f

# Verify installed Chrome version on Linux/macOS
google-chrome --version