CVE-2026-87465: Google Chrome Authorization Bypass Vulnerability

CVE-2026-87465 Overview

CVE-2026-87465 is an incorrect authorization vulnerability in the Downloads component of Google Chrome. The flaw affects versions prior to 153.0.8010.36 and is tracked under CWE-863: Incorrect Authorization. An attacker who has already compromised the renderer process can spoof user interface elements by delivering a crafted HTML page. Google classifies the Chromium security severity as Medium.

The issue requires user interaction and a compromised renderer, which limits real-world exploitability. Successful exploitation can mislead users into approving actions that appear legitimate but are attacker-controlled through the Downloads UI surface.

Critical Impact
A remote attacker with a compromised renderer process can spoof Chrome Downloads UI elements, enabling social engineering attacks that trick users into trusting malicious file operations.

Affected Products

Google Chrome versions prior to 153.0.8010.36
Chromium-based desktop builds derived from the same upstream code
Chrome Stable channel on Windows, macOS, and Linux

Discovery Timeline

2026-09-09 - CVE-2026-87465 published to NVD
2026-09-09 - Last updated in NVD database
2026-09 - Google releases Stable channel update for desktop including the fix

Technical Details for CVE-2026-87465

Vulnerability Analysis

The vulnerability resides in the Downloads subsystem of Chrome, where authorization checks are not correctly enforced against renderer-originated requests. When the renderer is compromised, the attacker can interact with the Downloads UI surface in ways the browser process should have restricted.

Because the renderer sits inside Chrome's sandbox, this bug alone does not grant code execution. Instead, it extends the attacker's reach into the trusted browser UI, allowing spoofing of elements that users rely on to make security decisions about downloads. The attack chain requires prior renderer compromise, which typically demands a separate memory-safety or logic bug.

Root Cause

The root cause is an authorization gap [CWE-863] between the renderer process and the browser process handling downloads. The Downloads component fails to validate that a given UI action or state change is permitted for the requesting renderer context. As a result, a malicious renderer can trigger UI states that should be reserved for the browser process or the user.

Attack Vector

The attack vector is network-based. The adversary hosts a crafted HTML page that first exploits a separate renderer compromise, then leverages the Downloads authorization flaw to render spoofed UI. User interaction is required, since the victim must visit the malicious page and act on the spoofed prompt. The spoofed elements can be used to disguise file origin, download prompts, or safety indicators, supporting downstream social engineering.

No public proof-of-concept, exploit code, or in-the-wild exploitation has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical detail is tracked in Chromium Issue Tracker #496616790.

Detection Methods for CVE-2026-87465

Indicators of Compromise

Chrome browser versions reporting a User-Agent below 153.0.8010.36 in enterprise telemetry
Unexpected download prompts or file save dialogs following visits to untrusted sites
Renderer process crashes or anomalous child-process spawning preceding download activity
Files written to disk that do not match the origin or file type shown in the Chrome UI

Detection Strategies

Inventory Chrome installations across managed endpoints and flag builds older than 153.0.8010.36
Correlate browser process telemetry with download events to detect renderer anomalies preceding file writes
Hunt for HTML pages served over HTTPS that trigger repeated Downloads UI interactions within a single session

Monitoring Recommendations

Enable enterprise reporting through Chrome Browser Cloud Management to track version compliance
Log and review chrome.exe command-line arguments, child processes, and file-write activity from browser processes
Monitor endpoint detection telemetry for downloads that do not match user-initiated navigation events

How to Mitigate CVE-2026-87465

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all desktop endpoints
Restart Chrome after applying the update to ensure the patched renderer and browser binaries are loaded
Verify that automatic updates are enabled and functioning across the managed fleet

Patch Information

Google addressed CVE-2026-87465 in the Chrome Stable channel update documented in the Google Chrome Stable Update. The fix is included in Chrome 153.0.8010.36 and later. Chromium-based downstream browsers should apply their respective vendor updates once the upstream fix is integrated.

Workarounds

Restrict browsing to trusted sites through URL filtering or Secure Web Gateway policy until patching completes
Train users to verify the origin of downloaded files through the Downloads page rather than the download shelf prompt
Enable Enhanced Safe Browsing in Chrome to increase warnings for suspicious downloads and sites

bash

# Verify installed Chrome version on Windows
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Verify installed Chrome version on macOS
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString

# Verify installed Chrome version on Linux
google-chrome --version