CVE-2026-87466: Google Chrome Authorization Bypass Vulnerability

CVE-2026-87466 Overview

CVE-2026-87466 is an incorrect authorization vulnerability in the Workers component of Google Chrome prior to version 153.0.8010.36. A remote attacker can bypass the web origin policy by convincing a user to visit a crafted HTML page. The flaw is categorized under [CWE-863] Incorrect Authorization and rated Medium severity by the Chromium security team. Exploitation requires user interaction, but no privileges or authentication are needed. Successful abuse can allow cross-origin data access, undermining a core browser isolation boundary.

Critical Impact
Attackers can bypass same-origin restrictions in Chrome Workers through a crafted web page, exposing data from other web origins.

Affected Products

Google Chrome versions prior to 153.0.8010.36 (Desktop Stable channel)
Chromium-based deployments consuming the vulnerable Workers implementation
All operating system builds of Chrome shipped before the September 2026 Stable update

Discovery Timeline

2026-09-09 - CVE-2026-87466 published to NVD
2026-09-09 - Last updated in NVD database
2026-09 - Google releases Stable channel update fixing the issue (Google Chrome Stable Update)

Technical Details for CVE-2026-87466

Vulnerability Analysis

The vulnerability resides in Chrome's Workers subsystem, which handles background script execution such as Web Workers, Shared Workers, and Service Workers. Workers operate under the same-origin policy and must enforce origin checks when handling network requests, message ports, and resource access. In vulnerable builds, an authorization check is either missing or incorrectly applied, allowing script running in a Worker context to interact with resources belonging to a different web origin.

A remote attacker hosts a crafted HTML page that instantiates a Worker performing the improperly authorized action. When a user loads the page, the Worker uses the flaw to read data or invoke functionality that should be blocked by origin isolation. The confidentiality impact is limited but real; integrity and availability are not affected per the reported CVSS metrics.

Root Cause

The root cause is an incorrect authorization check [CWE-863] within the Workers component. Rather than validating that the requesting Worker's origin matches the target resource's origin, the code path accepts requests that should be rejected. Details are tracked in the Chromium Issue Tracker Entry.

Attack Vector

Exploitation is network-based and requires user interaction: the victim must open or be redirected to the attacker-controlled page. No authentication or elevated privileges are needed. The attack scope remains within the browser sandbox, but data from other web origins loaded in the same browser session may be exposed. See the Chromium Issue Tracker Entry for technical particulars.

No public proof-of-concept exploit is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-87466

Indicators of Compromise

Chrome browser processes running versions earlier than 153.0.8010.36 on managed endpoints
Outbound connections from browser Worker threads to untrusted domains hosting suspicious HTML payloads
Unexpected cross-origin fetch or postMessage activity originating from Service Worker or Shared Worker contexts

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any build below 153.0.8010.36
Monitor browser telemetry and proxy logs for repeated visits to newly registered or low-reputation domains delivering HTML containing new Worker(...) or navigator.serviceWorker.register(...) patterns
Correlate browser process behavior with data access anomalies indicating cross-origin leakage

Monitoring Recommendations

Enable centralized browser version reporting through Chrome Enterprise or endpoint management tooling
Ingest web proxy and DNS logs into a SIEM to identify user navigations to attacker infrastructure
Track user-agent strings on internal applications to detect outdated Chrome clients that remain exposed

How to Mitigate CVE-2026-87466

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all Windows, macOS, and Linux endpoints
Force a browser restart after patch deployment to ensure the fixed binary is loaded
Verify update status across managed endpoints and remediate stragglers that failed to auto-update

Patch Information

Google addressed CVE-2026-87466 in the Chrome Stable channel release documented in the Google Chrome Stable Update. The fix is included in Chrome 153.0.8010.36 and later. Chromium-based browsers that consume the upstream Workers code should pull the corresponding patch from the Chromium Issue Tracker Entry.

Workarounds

Restrict browsing to trusted sites using enterprise URL allow-lists until patching completes
Deploy Chrome Enterprise policies to disable Service Workers on sensitive user profiles where feasible
Use network-layer filtering to block known malicious domains and newly registered domains during the exposure window

bash

# Verify Chrome version on Linux endpoints
google-chrome --version

# Force update via Chrome Enterprise policy (Linux example)
cat <<'EOF' > /etc/opt/chrome/policies/managed/chrome_update.json
{
  "TargetVersionPrefix": "153.0.8010.36",
  "UpdateDefault": 1
}
EOF