CVE-2026-87461: Google Chrome Information Disclosure Flaw

CVE-2026-87461 Overview

CVE-2026-87461 is an information disclosure vulnerability in the Core component of Google Chrome. The flaw affects Chrome versions prior to 153.0.8010.36 and allows a remote attacker to leak cross-origin data through a crafted Chrome extension. Chromium classifies the security severity as Low, while the NVD assigns a medium rating driven by the network attack vector and required user interaction (installing the malicious extension). The weakness is tracked under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
A malicious Chrome extension can read data from origins the extension should not have access to, breaking the browser's same-origin isolation guarantees.

Affected Products

Google Chrome desktop versions prior to 153.0.8010.36
Chromium-based browsers that inherit the vulnerable Core component
Enterprise Chrome deployments on the Stable channel before the September 2026 update

Discovery Timeline

2026-09-09 - CVE-2026-87461 published to the National Vulnerability Database
2026-09-09 - Google Chrome Stable channel update released addressing the flaw
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87461

Vulnerability Analysis

The vulnerability resides in Chrome's Core component and permits cross-origin data leakage when triggered through a crafted browser extension. Extensions run with elevated privileges relative to standard web content, using extension APIs that can interact with multiple origins. A defect in origin enforcement inside Core lets an attacker-controlled extension observe or retrieve data belonging to origins outside its declared host permissions.

The practical impact is limited to confidentiality: an attacker can read cross-origin resources but cannot modify them or affect availability. Successful exploitation requires the victim to install a malicious or compromised extension, which places the attack in the supply-chain and social-engineering categories rather than drive-by browsing.

Exploit prediction data reflects the constraint. No public proof-of-concept, exploit code, or in-the-wild activity has been reported, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is insufficient origin checking within the Core component when handling requests or data flows originating from extension contexts. Chrome's security model relies on strict same-origin enforcement between web origins and on host permission checks between extensions and origins. When Core fails to validate the requesting origin correctly, an extension can obtain data it should not see.

Attack Vector

Exploitation follows a two-stage pattern. First, the attacker publishes or compromises a Chrome extension containing the crafted logic that exercises the flawed code path. Second, a victim installs the extension, at which point it can silently harvest cross-origin data such as authenticated responses, tokens, or page content from sites the user visits. Because the attack requires only user consent to install an extension, it aligns with common malicious extension distribution techniques.

No verified proof-of-concept has been released. Refer to the Chromium Issue Tracker Entry for the authoritative technical description once the bug is unrestricted.

Detection Methods for CVE-2026-87461

Indicators of Compromise

Chrome browsers reporting a version string earlier than 153.0.8010.36 in enterprise inventory telemetry
Installation events for extensions from unknown publishers or sideloaded outside the Chrome Web Store
Extension processes issuing network requests to origins not declared in the extension's host_permissions manifest field

Detection Strategies

Inventory installed Chrome extensions across managed endpoints and compare extension IDs against an approved allowlist
Monitor Chrome update compliance and flag hosts pinned to versions before 153.0.8010.36
Review browser management console reports for extensions requesting broad host permissions or <all_urls> scope

Monitoring Recommendations

Enable Chrome Enterprise reporting to forward extension install, update, and permission-change events to the SIEM
Alert on extensions that transmit response bodies or headers from third-party origins to attacker-controlled endpoints
Track user reports of unexpected session terminations or account activity that could indicate token or cookie leakage

How to Mitigate CVE-2026-87461

Immediate Actions Required

Update Chrome to version 153.0.8010.36 or later on all managed endpoints
Audit installed extensions and remove any that are unused, unsigned, or from untrusted publishers
Restrict extension installation to a curated allowlist through Chrome Enterprise policy

Patch Information

Google released the fix in the Stable channel update announced on September 9, 2026. Administrators should validate that endpoints have received 153.0.8010.36 or a later build. See the Google Chrome Update Announcement for full release notes and the Chromium Issue Tracker Entry for the underlying bug reference.

Workarounds

Enforce the ExtensionInstallAllowlist and ExtensionInstallBlocklist policies to prevent installation of arbitrary extensions until patching is verified
Disable developer mode for extensions on managed profiles to block sideloading of unsigned packages
Require review and approval of new extension requests through IT before user installation

bash

# Configuration example - Chrome Enterprise policy (Linux managed_policies)
# /etc/opt/chrome/policies/managed/extension_controls.json
{
  "ExtensionInstallBlocklist": ["*"],
  "ExtensionInstallAllowlist": [
    "aapocclcgogkmnckokdopfmhonfmgoek"
  ],
  "DeveloperToolsAvailability": 2,
  "ExtensionSettings": {
    "*": {
      "installation_mode": "blocked",
      "runtime_blocked_hosts": ["<all_urls>"]
    }
  }
}