CVE-2026-87449: Google Chrome CSRF Vulnerability

CVE-2026-87449 Overview

CVE-2026-87449 is a cross-site request forgery (CSRF) vulnerability in the DeviceBoundSessionCredentials component of Google Chrome. The flaw affects Chrome versions prior to 153.0.8010.36 and allows a remote attacker to bypass web origin policy via a crafted HTML page. Google classifies the Chromium security severity as Medium. The vulnerability is tracked under CWE-352 and requires user interaction to trigger. Exploitation targets the browser's session credential binding mechanism, weakening origin isolation guarantees that browsers rely on to separate untrusted web content.

Critical Impact
A remote attacker can bypass the web origin policy in Chrome by luring a user to a crafted HTML page, undermining a core browser security boundary.

Affected Products

Google Chrome versions prior to 153.0.8010.36
Chromium-based desktop builds sharing the DeviceBoundSessionCredentials implementation
Downstream browsers that have not integrated the upstream Chromium fix

Discovery Timeline

2026-09-09 - CVE-2026-87449 published to NVD
2026-09-09 - Last updated in NVD database
2026-09 - Google releases fixed Chrome Stable channel build 153.0.8010.36 per the Chrome Stable Channel Update

Technical Details for CVE-2026-87449

Vulnerability Analysis

The vulnerability resides in Chrome's DeviceBoundSessionCredentials feature, which binds session credentials to a specific device using cryptographic keys. This mechanism is intended to strengthen session security by ensuring that stolen cookies cannot be reused from another device. The CSRF flaw in this component permits cross-origin requests to influence device-bound session state in ways the origin policy should prevent. The impact scope is limited to confidentiality of data reachable via the abused session context. Exploitation requires user interaction, typically visiting an attacker-controlled page.

Root Cause

The root cause is missing or insufficient CSRF protection in the request path used by DeviceBoundSessionCredentials. Requests originating from a third-party origin are processed without adequate validation of the initiating origin or a synchronizer token. This weakens the same-origin guarantees that gate credentialed operations. Refer to the Chromium Issue Tracker Entry for upstream analysis.

Attack Vector

An attacker hosts a crafted HTML page that issues cross-origin requests targeting the DeviceBoundSessionCredentials endpoints. When a victim using a vulnerable Chrome version loads that page, the browser processes the requests in a manner that bypasses the intended web origin policy. The vector is network-based and requires user interaction, but no authentication or elevated privileges are needed on the attacker side.

No verified public proof-of-concept is available. The vulnerability mechanism is described in the Chromium Issue Tracker Entry and the Chrome Stable Channel Update.

Detection Methods for CVE-2026-87449

Indicators of Compromise

Chrome browser processes reporting a version string below 153.0.8010.36 in enterprise inventory telemetry.
Outbound web traffic to unfamiliar domains immediately followed by anomalous authenticated requests to internal or SaaS origins.
Browser telemetry showing cross-origin requests interacting with device-bound session credential endpoints.

Detection Strategies

Inventory Chrome installations across managed endpoints and flag any build older than 153.0.8010.36.
Monitor web proxy or DNS logs for user visits to newly registered or low-reputation domains preceding suspicious session activity.
Correlate authentication events for SaaS applications with browser referrer and origin telemetry to detect origin-policy anomalies.

Monitoring Recommendations

Ingest browser version telemetry and web proxy logs into a centralized analytics pipeline for continuous version compliance checks.
Alert on session credential reuse patterns that deviate from established per-user baselines.
Track patch adoption rates for Chrome across the fleet and escalate endpoints that lag behind the fixed build.

How to Mitigate CVE-2026-87449

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints.
Force-restart Chrome after the update to ensure the patched binary is loaded into memory.
Verify downstream Chromium-based browsers used in the environment have integrated the corresponding upstream fix.

Patch Information

Google addressed CVE-2026-87449 in the Chrome Stable channel build 153.0.8010.36. Deployment details are documented in the Chrome Stable Channel Update. Enterprise administrators should distribute the update through existing Chrome update policies or endpoint management tooling.

Workarounds

Restrict browsing to trusted sites via enterprise policy until patched builds are deployed.
Enforce Chrome auto-update policies through group policy or MDM to reduce time-to-patch.
Educate users to avoid clicking untrusted links, since exploitation requires loading a crafted HTML page.

bash

# Verify Chrome version on managed endpoints
# Linux / macOS
google-chrome --version

# Windows (PowerShell)
(Get-Item "$env:ProgramFiles\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# Compare output against fixed build: 153.0.8010.36