CVE-2026-87450: Google Chrome Information Disclosure Flaw

CVE-2026-87450 is an information disclosure vulnerability in Google Chrome caused by incorrect authorization in Permissions. Attackers can exploit this flaw through malicious extensions to access sensitive data. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-87450 Overview

CVE-2026-87450 is an incorrect authorization vulnerability in the Permissions component of Google Chrome. The flaw affects Chrome versions prior to 153.0.8010.36 and enables a remote attacker to obtain sensitive information through a crafted Chrome extension combined with social engineering. Google classified the underlying Chromium security severity as Medium, while the National Vulnerability Database rates the issue High with a CVSS score of 7.5. The weakness maps to CWE-863: Incorrect Authorization. Successful exploitation impacts confidentiality without requiring authentication or user interaction beyond installing the malicious extension.

Critical Impact
A remote attacker distributing a crafted Chrome extension can bypass permission checks and exfiltrate sensitive browser data from affected users.

Affected Products

Google Chrome versions prior to 153.0.8010.36 on desktop platforms
Chromium-based browsers that share the vulnerable Permissions code path
Chrome extension permission enforcement subsystem

Discovery Timeline

2026-09-09 - CVE-2026-87450 published to the National Vulnerability Database
2026-09-10 - CVE record last modified in NVD

Technical Details for CVE-2026-87450

Vulnerability Analysis

The vulnerability resides in the Permissions component that governs how Chrome evaluates and enforces access requests from installed extensions. Chrome grants extensions access to browser APIs, tabs, storage, and web content based on declared permissions and user consent. An authorization check within this subsystem fails to correctly validate the requesting context, allowing an extension to access resources it should not reach. The attacker relies on social engineering to convince a user to install the crafted extension from outside or within official distribution channels. Once installed, the extension leverages the flawed check to read sensitive information such as cookies, browsing data, or content from other origins. The attack targets confidentiality only; integrity and availability of the browser remain intact.

Root Cause

The root cause is an incorrect authorization decision [CWE-863] inside Chrome's Permissions logic. The permission gate accepts or evaluates a request context in a way that grants broader access than the extension's declared scope should allow. This class of flaw typically stems from mismatched permission scopes, missing origin checks, or trust boundaries that assume extension identity implies authorization.

Attack Vector

The attack vector is network-based and requires no prior authentication. An attacker publishes or distributes a Chrome extension containing exploitation logic, then uses social engineering such as phishing pages, misleading install prompts, or lookalike branding to persuade the victim to install it. After installation, the extension issues API calls that trigger the incorrect authorization path and returns sensitive data to attacker-controlled infrastructure. Refer to the Chromium Issue Tracker entry 517432155 and the Google Chrome Stable Update advisory for vendor context.

Detection Methods for CVE-2026-87450

Indicators of Compromise

Newly installed Chrome extensions from unofficial sources or side-loaded via developer mode
Outbound HTTPS traffic from browser processes to domains that do not match user browsing patterns
Chrome extension manifests requesting broad host permissions such as <all_urls> shortly after install
Unexpected reads of cookie stores or chrome.storage by recently installed extensions

Detection Strategies

Inventory installed browser extensions across managed endpoints and compare against an approved allowlist
Monitor Chrome version telemetry to identify hosts running builds earlier than 153.0.8010.36
Correlate extension install events with subsequent anomalous network egress from the browser process

Monitoring Recommendations

Enable Chrome Enterprise reporting to forward extension install and permission events to a central log store
Alert on any extension requesting sensitive permissions outside a review workflow
Track browser process activity for exfiltration patterns such as large POSTs to newly seen domains

How to Mitigate CVE-2026-87450

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all desktop endpoints
Audit installed extensions and remove any that are unknown, unnecessary, or side-loaded
Restrict extension installation to an administrator-approved allowlist via enterprise policy

Patch Information

Google addressed the vulnerability in the Chrome Stable channel release documented in the Chrome Releases advisory. Users should verify Chrome reports version 153.0.8010.36 or higher through chrome://settings/help. Managed environments should push the update through Chrome Enterprise, Group Policy, or endpoint management tooling.

Workarounds

Deploy the ExtensionInstallAllowlist and ExtensionInstallBlocklist policies to control which extensions users can install
Disable extension installation from outside the Chrome Web Store using BlockExternalExtensions
Educate users to recognize social engineering lures that push browser extensions

bash

# Configuration example
# Chrome Enterprise policy to restrict extensions (Linux example)
sudo tee /etc/opt/chrome/policies/managed/extension_policy.json > /dev/null <<EOF
{
  "ExtensionInstallBlocklist": ["*"],
  "ExtensionInstallAllowlist": [
    "<approved-extension-id-1>",
    "<approved-extension-id-2>"
  ],
  "BlockExternalExtensions": true
}
EOF