CVE-2026-87457: Google Chrome Race Condition Vulnerability

CVE-2026-87457 Overview

CVE-2026-87457 is a race condition vulnerability in the Updater component of Google Chrome on Windows. The flaw affects versions prior to 153.0.8010.36 and stems from a Time-of-Check Time-of-Use (TOCTOU) weakness classified under [CWE-367]. A local attacker who can run a program on the target system can exploit the race to execute arbitrary code outside the Chrome sandbox. Google's Chromium team rated the underlying issue as Medium severity, though the NVD scoring reflects High severity due to the scope change and full compromise of confidentiality, integrity, and availability.

Critical Impact
Successful exploitation lets a local, unprivileged program escape the Chrome sandbox and execute arbitrary code with the privileges of the Chrome Updater process on Windows.

Affected Products

Google Chrome on Windows prior to 153.0.8010.36
Microsoft Windows hosts running vulnerable Chrome builds
Google Chrome Updater component (GoogleUpdater)

Discovery Timeline

2026-09-09 - CVE-2026-87457 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87457

Vulnerability Analysis

The vulnerability resides in the Google Chrome Updater on Windows. The Updater runs with elevated privileges to install and maintain Chrome across user sessions. A race condition [CWE-367] exists between the point at which the Updater validates a resource and the point at which it acts on that resource. A local attacker who wins the race can substitute attacker-controlled content and cause the Updater to operate on it, breaking the sandbox boundary and executing code in the Updater's context.

Because the flaw lives in the Updater rather than the renderer, exploitation bypasses standard Chrome sandbox mitigations that constrain web content. Successful exploitation results in arbitrary code execution outside the Chrome sandbox on the Windows host.

Root Cause

The root cause is a TOCTOU flaw in the Chrome Updater on Windows. State that the Updater validates during a security check changes before the Updater consumes it. This atomicity gap [CWE-367] allows a concurrently running local program to alter file, path, or handle state between the check and the use, redirecting the Updater to attacker-controlled input.

Attack Vector

The attack vector is local. An attacker must already be able to execute a program on the Windows host as an unprivileged local user. The attacker then runs a program that races the Chrome Updater during an update or maintenance operation to satisfy the security check with legitimate state, then swap in malicious state before the Updater acts. User interaction is not required, but attack complexity is high because the attacker must reliably win the race window. See the Chromium Issue #497837188 tracker and the Google Chrome Stable Update advisory for vendor context.

Detection Methods for CVE-2026-87457

Indicators of Compromise

Unexpected child processes spawned by GoogleUpdater.exe or updater.exe that are not signed Google binaries.
New or modified files under the Google Update install directory (%ProgramFiles(x86)%\Google\Update\ or %ProgramFiles%\Google\GoogleUpdater\) written by non-Google processes.
Local processes creating symbolic links, junctions, or hard links that target Chrome Updater paths shortly before an update event.
Suspicious handle duplication or file rename activity against Updater working directories from unprivileged user processes.

Detection Strategies

Monitor process ancestry for the Chrome Updater and alert when it launches non-Google-signed executables.
Baseline expected file paths touched by the Updater and flag writes originating from user-mode, non-elevated processes.
Correlate rapid file create, delete, and rename bursts in Updater directories with concurrent Updater activity to surface race attempts.

Monitoring Recommendations

Enable Windows Sysmon event IDs 1, 11, and 13 to capture process creation and file activity around Updater paths.
Track scheduled task and service executions tied to GoogleUpdaterInternalService and GoogleUpdaterService for anomalous invocations.
Ingest endpoint telemetry into a centralized data lake and retain it long enough to reconstruct sub-second race sequences.

How to Mitigate CVE-2026-87457

Immediate Actions Required

Update Google Chrome on Windows to 153.0.8010.36 or later on every managed endpoint.
Verify that the Chrome Updater service is running and that automatic updates have applied successfully.
Restrict local logon rights on servers and shared workstations to reduce the population of users able to stage a local race.
Audit endpoints for unsigned binaries or scripts that interact with Chrome Updater directories.

Patch Information

Google fixed the issue in Chrome 153.0.8010.36 on the Stable channel for Windows. Refer to the Google Chrome Stable Update advisory for the full release notes and to Chromium Issue #497837188 for the tracked bug. Enterprises using managed Chrome deployments should confirm that Google Update policies are not blocking the patched build.

Workarounds

No official workaround is published; apply the vendor patch as the primary remediation.
Where patching is delayed, enforce least privilege so standard users cannot run arbitrary programs that could race the Updater.
Apply application control policies (for example, Windows Defender Application Control or AppLocker) to block unsigned binaries from executing on managed endpoints.

bash

# Verify installed Chrome version on Windows (PowerShell)
(Get-Item "$env:ProgramFiles\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# Confirm the Google Updater services are present and running
Get-Service -Name "GoogleUpdaterService*","GoogleUpdaterInternalService*"