CVE-2026-87452: Google Chrome GPU Auth Bypass Vulnerability

CVE-2026-87452 Overview

CVE-2026-87452 is an incorrect authorization vulnerability [CWE-863] in the GPU component of Google Chrome on macOS. The flaw affects Chrome versions prior to 153.0.8010.36. An attacker who has already compromised the renderer process can potentially obtain cross-origin data by serving a crafted HTML page to the victim. Google classifies the Chromium security severity as Medium, while the NVD CVSS v3.1 base score is 3.1.

Critical Impact
Successful exploitation allows a remote attacker with a compromised renderer to read cross-origin data, bypassing the Same-Origin Policy enforced by the GPU process on macOS.

Affected Products

Google Chrome on macOS prior to 153.0.8010.36
Apple macOS (host operating system for the affected Chrome builds)
Chromium-based rendering pipelines that share the vulnerable GPU authorization path

Discovery Timeline

2026-09-09 - CVE-2026-87452 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87452

Vulnerability Analysis

The vulnerability resides in Chrome's GPU process, which mediates graphics operations on behalf of sandboxed renderer processes. Chrome's security model requires the GPU process to enforce origin-based authorization on resources it exposes to renderers. On macOS builds prior to 153.0.8010.36, this authorization check is incorrect, permitting a renderer to reference GPU-managed resources that belong to a different web origin.

Exploitation is not a direct network attack. It requires the attacker to first compromise the renderer process, typically by chaining this issue with a separate renderer-level bug, and then to lure the victim to a crafted HTML page. The end result is disclosure of cross-origin data such as pixel contents or texture buffers that the Same-Origin Policy should isolate.

The EPSS score is 0.209% (percentile 11.07), reflecting the constrained exploitation path and the need for a renderer compromise precondition.

Root Cause

The defect is an incorrect authorization check [CWE-863] within the GPU process on macOS. Cross-origin resource access is validated against inputs that a compromised renderer can influence, so the GPU trusts the caller's assertion rather than independently verifying origin ownership. This turns the GPU boundary into a confused deputy for cross-origin reads.

Attack Vector

The attack requires network delivery of a crafted HTML page and user interaction, typically a page visit. It also requires a prior compromise of the renderer process, which is the practical barrier to standalone exploitation. Once these preconditions are met, the compromised renderer issues GPU commands that reference cross-origin resources and receives data that should be blocked by the browser's origin isolation.

No public proof-of-concept, exploit database entry, or in-the-wild exploitation has been reported. See the Chromium Issue Tracker #513524705 for tracking details.

Detection Methods for CVE-2026-87452

Indicators of Compromise

Managed macOS endpoints running Google Chrome versions earlier than 153.0.8010.36
Chrome GPU process crashes or unusual GPU command traffic originating from renderer processes that recently loaded untrusted content
Browser telemetry showing renderer processes issuing anomalous IPC to the GPU process shortly after visiting attacker-controlled pages

Detection Strategies

Inventory installed Chrome versions on macOS fleets and flag hosts below 153.0.8010.36
Correlate web proxy logs with endpoint process telemetry to identify Chrome sessions visiting low-reputation domains that immediately precede renderer or GPU process anomalies
Monitor for exploitation chains, since this issue requires a prior renderer compromise, and alert on known Chrome renderer exploit indicators

Monitoring Recommendations

Ingest Chrome update and version telemetry into your SIEM to continuously verify patch state
Track macOS crash reports for Google Chrome Helper (GPU) to surface exploitation attempts
Alert on renderer processes spawning unexpected child processes or writing to unusual filesystem paths, which frequently accompanies sandbox-adjacent exploitation

How to Mitigate CVE-2026-87452

Immediate Actions Required

Update Google Chrome on macOS to version 153.0.8010.36 or later across managed endpoints
Verify enterprise update policies deliver the stable channel patch and are not deferring Chrome updates beyond the release window
Restart Chrome after the update installs so the patched GPU process binary is loaded

Patch Information

Google addressed the issue in the Chrome stable channel release documented in the Chrome Stable Channel Update. The fix is included in Chrome 153.0.8010.36 for macOS. No workaround is a substitute for applying the vendor patch.

Workarounds

Limit exposure by restricting Chrome usage on macOS to trusted sites until the patch is deployed
Enforce site isolation and keep the GPU sandbox enabled; do not launch Chrome with flags that disable the GPU process or sandboxing
Use enterprise policy to block installation of untrusted extensions that could increase the likelihood of a renderer compromise precondition

bash

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Force an update check via the Google Update helper
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/GoogleSoftwareUpdateAgent --check-now