CVE-2026-87451 Overview
CVE-2026-87451 is an information disclosure vulnerability in the Downloads component of Google Chrome prior to version 153.0.8010.36. A remote attacker who has already compromised the renderer process can obtain cross-origin data by serving a crafted HTML page to a victim. The flaw is tracked under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor and was rated Medium severity by the Chromium project. Google addressed the issue in the Stable channel desktop update released via the Chrome Releases blog.
Critical Impact
An attacker with a compromised renderer can bypass same-origin protections in the Downloads pipeline and read data belonging to other web origins.
Affected Products
- Google Chrome Desktop versions prior to 153.0.8010.36
- Chromium-based browsers that share the vulnerable Downloads code path
- Downstream builds packaging Chromium releases before the September 2026 Stable channel update
Discovery Timeline
- 2026-09-09 - CVE-2026-87451 published to the National Vulnerability Database (NVD)
- 2026-09-09 - Last updated in NVD database
- Vendor advisory published on the Chrome Releases blog with tracking in Chromium Issue #517178299
Technical Details for CVE-2026-87451
Vulnerability Analysis
The vulnerability resides in Chrome's Downloads subsystem, which mediates requests originating from renderer processes and coordinates fetches with the browser process. The Downloads pipeline is expected to enforce origin boundaries when handling resources that a renderer requests for download. In vulnerable builds this enforcement is incomplete, allowing a renderer to reference cross-origin resources and observe response data it should not see.
Exploitation requires a preceding compromise of the renderer process. The renderer then serves a crafted HTML page that abuses the Downloads path to fetch and expose data from a different origin. The attack is remote but requires user interaction, and Chromium engineers rated exploitability as high complexity due to the prerequisite renderer compromise. Impact is limited to confidentiality; the flaw does not modify data or affect availability.
Root Cause
The root cause is improper cross-origin data segregation (CWE-200) inside the Downloads component. Data intended to remain isolated by the Same-Origin Policy becomes accessible when routed through the download flow from a hostile renderer. No verified public technical write-up is available; details are restricted in Chromium Issue #517178299.
Attack Vector
The attack chain has two stages. First, the attacker compromises the renderer process, typically through a separate memory corruption or logic bug. Second, the attacker delivers a crafted HTML page that triggers download-related requests to cross-origin endpoints and reads back the response content. The victim must load the attacker-controlled page, satisfying the user interaction requirement.
No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2026-87451
Indicators of Compromise
- Chrome browser processes running versions earlier than 153.0.8010.36 in enterprise inventories
- Unexpected download-initiation events targeting sensitive internal origins from browser sessions on untrusted external pages
- Renderer process crashes or sandbox anomalies preceding cross-origin download activity, suggesting a chained renderer compromise
Detection Strategies
- Inventory browser versions across managed endpoints and flag Chrome installations below the patched build
- Correlate web proxy and DNS telemetry for browser requests to internal origins immediately following visits to untrusted domains
- Alert on browser child-process anomalies such as unexpected renderer restarts paired with new download tasks
Monitoring Recommendations
- Ingest browser and endpoint telemetry into a centralized data lake to enable cross-source correlation of renderer behavior and network activity
- Track compliance with the Chrome 153.0.8010.36 baseline through automated version reporting
- Monitor Chromium security release channels for follow-up advisories referencing Chromium Issue #517178299
How to Mitigate CVE-2026-87451
Immediate Actions Required
- Update Google Chrome Desktop to version 153.0.8010.36 or later on all managed endpoints
- Restart Chrome after the update so the patched binaries load in active user sessions
- Verify that auto-update is enabled and functioning through enterprise management policies
Patch Information
Google released the fix in the Stable channel desktop update documented on the Chrome Releases blog. Administrators managing Chromium-based browsers should confirm that their vendor has merged the corresponding upstream patch referenced in Chromium Issue #517178299.
Workarounds
- No vendor-supplied workaround is published; patching is the supported remediation
- Reduce user exposure by restricting navigation to untrusted sites through enterprise web filtering until the update is deployed
- Enforce site isolation and strong sandboxing policies through Chrome Enterprise settings to raise the cost of the prerequisite renderer compromise
# Verify installed Chrome version on Linux endpoints
google-chrome --version
# Windows: query the installed version from the registry
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
