CVE-2026-87454: Google Chrome Information Disclosure Flaw

CVE-2026-87454 Overview

CVE-2026-87454 is an information disclosure vulnerability in the Enterprise component of Google Chrome on Windows. The flaw affects Chrome versions prior to 153.0.8010.36. A remote attacker can exploit the vulnerability by convincing a user to visit a crafted HTML page, resulting in the disclosure of sensitive information from the browser process. The issue is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Google has rated the Chromium security severity as Medium. Exploitation requires user interaction but no authentication or elevated privileges.

Critical Impact
Successful exploitation allows a remote attacker to obtain sensitive information from Chrome on Windows through a malicious web page, without requiring authentication.

Affected Products

Google Chrome on Windows prior to 153.0.8010.36
Microsoft Windows systems running affected Chrome builds
Enterprise deployments of Chrome managed via Chrome Enterprise policies

Discovery Timeline

2026-09-09 - CVE-2026-87454 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87454

Vulnerability Analysis

The vulnerability resides in the Enterprise component of Google Chrome for Windows. An attacker hosts a crafted HTML page and lures a user into visiting it. When the page is rendered, Chrome exposes sensitive information that should remain isolated within the browser process or restricted to the origin. The flaw does not permit code execution or content modification, but confidentiality of browser-held data is impacted. Because delivery occurs through standard web navigation, the attack scales to any user who can be directed to attacker-controlled content. Enterprise-managed Chrome deployments are within scope because the affected component ties to enterprise policy handling.

Root Cause

The root cause is improper isolation or handling of sensitive data within the Enterprise component of Chrome, resulting in unauthorized exposure to web content. Consult Chromium Issue Report #520389619 for the underlying defect details as Google discloses them.

Attack Vector

Exploitation requires the victim to load attacker-controlled HTML in a vulnerable Chrome build. No credentials or prior access to the target system are needed. The attacker can deliver the page through phishing, malvertising, watering-hole compromise, or embedded iframes on otherwise-trusted sites. Once rendered, the crafted content triggers the disclosure primitive and returns sensitive data to the attacker.

No public proof-of-concept exploit code has been released. Refer to the Google Chrome Stable Update advisory for vendor-provided details.

Detection Methods for CVE-2026-87454

Indicators of Compromise

Chrome browser processes on Windows endpoints running versions earlier than 153.0.8010.36
Outbound web requests to unfamiliar domains immediately following user navigation to unknown links
Enterprise policy-managed Chrome instances that have not received the September 2026 stable channel update

Detection Strategies

Inventory installed Chrome versions across Windows endpoints and flag any build below 153.0.8010.36
Correlate browser telemetry with proxy and DNS logs to identify visits to newly registered or low-reputation domains delivering HTML payloads
Monitor Chrome Enterprise update reporting for delayed patch deployment across managed fleets

Monitoring Recommendations

Enable browser update compliance reporting through Chrome Enterprise Core or equivalent management tooling
Feed endpoint browser version data and web proxy logs into a centralized SIEM for continuous coverage analysis
Alert on user reports of unexpected browser behavior after visiting external links

How to Mitigate CVE-2026-87454

Immediate Actions Required

Update Google Chrome on all Windows endpoints to version 153.0.8010.36 or later
Force restart of Chrome processes after update to ensure the patched binary is active
Verify enterprise-managed Chrome installations have received the update through Chrome Enterprise policies
Prioritize patching for users who handle sensitive data or browse untrusted content

Patch Information

Google addressed the vulnerability in the Stable channel update for desktop released via the Chrome Releases blog. The fixed version is 153.0.8010.36 for Windows. Chrome typically updates automatically, but enterprise-managed environments may require explicit action to accelerate rollout.

Workarounds

Restrict browsing to trusted domains via enterprise web filtering until the patch is deployed
Apply Chrome Enterprise policies that block or warn on navigation to uncategorized or newly observed domains
Educate users to avoid clicking untrusted links delivered through email, chat, or social media until update completes

bash

# Verify installed Chrome version on Windows endpoints
reg query "HKLM\SOFTWARE\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Force Chrome update check via Group Policy managed environment
gpupdate /force