CVE-2026-87459: Google Chrome Information Disclosure Flaw

CVE-2026-87459 Overview

CVE-2026-87459 is an observable discrepancy vulnerability in the Select component of Google Chrome versions prior to 153.0.8010.36. A remote attacker can obtain sensitive information by convincing a user to load a crafted HTML page. The Chromium project classified the underlying issue as low severity, though the National Vulnerability Database rates it medium due to network reachability and potential confidentiality impact. The flaw falls under [CWE-203] Observable Discrepancy, where differences in system behavior leak information usable for inference attacks.

Critical Impact
A remote attacker can extract sensitive information from a victim's browser session by luring the user to a specially crafted HTML page that abuses the Select element.

Affected Products

Google Chrome versions prior to 153.0.8010.36
Chromium-based browsers that inherit the vulnerable Select implementation
Desktop Stable channel builds (Windows, macOS, Linux)

Discovery Timeline

2026-09-09 - CVE-2026-87459 published to NVD
2026-09-09 - Last updated in NVD database
2026-09 - Google releases Stable channel update addressing the issue

Technical Details for CVE-2026-87459

Vulnerability Analysis

The vulnerability is an observable discrepancy in Chrome's Select element implementation. Observable discrepancy flaws [CWE-203] occur when a component produces different observable behaviors, such as timing, response size, or rendering artifacts, based on protected internal state. An attacker who can observe those differences can infer information that should remain confidential.

In this case, a crafted HTML page can interact with <select> elements in a way that produces distinguishable outputs tied to sensitive data. The attack targets confidentiality only. Integrity and availability of the browser and host system remain unaffected, according to the published CVSS vector. User interaction is required, meaning the victim must load or interact with the attacker-controlled page.

The attack requires no authentication and no elevated privileges. Exploitation runs entirely within the browser sandbox but still permits information disclosure across the security boundary the Select component is expected to enforce.

Root Cause

The root cause is inconsistent behavior in the Select rendering or event-handling path that varies based on cross-origin or otherwise protected data. Refer to the Chromium Issue Tracker Entry for implementation-level details maintained by the Chromium security team.

Attack Vector

Exploitation follows a standard drive-by pattern. The attacker hosts a crafted HTML page and lures the target through phishing, malvertising, or a compromised site. When the victim loads the page, embedded scripts interact with <select> elements and measure the observable discrepancy to infer sensitive values. No verified proof-of-concept code is publicly available at this time.

Detection Methods for CVE-2026-87459

Indicators of Compromise

Browser telemetry showing Chrome builds older than 153.0.8010.36 in active use across managed endpoints
Access logs referencing untrusted third-party domains that serve pages with unusual scripted interaction against <select> elements
Repeated navigation events to newly registered or low-reputation domains preceding sensitive-data exposure incidents

Detection Strategies

Inventory installed Chrome versions using endpoint management tooling and flag any host below 153.0.8010.36
Correlate web proxy logs with threat intelligence feeds to identify visits to domains hosting malicious HTML payloads
Monitor for anomalous outbound requests from browser processes that follow user interaction with untrusted pages

Monitoring Recommendations

Ingest browser version telemetry and web proxy events into a centralized SIEM for continuous version compliance checks
Alert on Chrome processes spawning unexpected child processes or making network calls to suspicious domains after page load
Track patch adoption metrics against Google's Stable channel release cadence to shorten exposure windows

How to Mitigate CVE-2026-87459

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints
Force-restart Chrome after update deployment to ensure the patched binary is loaded
Audit Chromium-based browsers such as Edge, Brave, and Opera and apply their corresponding vendor patches

Patch Information

Google addressed the issue in the Stable channel update documented at the Chrome Releases Update. Administrators should deploy Chrome 153.0.8010.36 or newer through their standard software distribution channel and verify installation across the fleet.

Workarounds

Restrict browsing to trusted sites through web filtering while patch deployment is in progress
Disable or restrict JavaScript on untrusted origins using enterprise browser policies
Educate users to avoid opening links from unsolicited email or messaging platforms until the update is applied

bash

# Configuration example: enforce minimum Chrome version via enterprise policy (Windows registry)
reg add "HKLM\Software\Policies\Google\Chrome" /v TargetVersionPrefix /t REG_SZ /d "153.0.8010.36" /f

# Linux: verify installed Chrome version
google-chrome --version