CVE-2026-87467: Google Chrome Race Condition Vulnerability

CVE-2026-87467 Overview

CVE-2026-87467 is a race condition vulnerability in the Updater component of Google Chrome on Windows. The flaw affects Chrome versions prior to 153.0.8010.36 and is classified under [CWE-362] (Concurrent Execution using Shared Resource with Improper Synchronization). A local attacker with the ability to run a program on the target system can exploit the race window to execute arbitrary code outside the Chrome sandbox. Google's Chromium team rated the underlying security severity as High. The vulnerability requires local access but no user interaction or privileges, and successful exploitation can compromise system integrity beyond the browser's protection boundary.

Critical Impact
Local attackers can escape the Chrome sandbox and execute arbitrary code on Windows systems running vulnerable Chrome Updater versions.

Affected Products

Google Chrome on Windows prior to 153.0.8010.36
Microsoft Windows (all supported versions running vulnerable Chrome builds)
Google Chrome Updater component (Windows platform)

Discovery Timeline

2026-09-09 - CVE-2026-87467 published to NVD
2026-09-10 - Last updated in NVD database
2026-09 - Google releases stable channel update addressing the flaw

Technical Details for CVE-2026-87467

Vulnerability Analysis

The vulnerability resides in the Chrome Updater, a privileged Windows service responsible for downloading and installing Chrome updates. A race condition ([CWE-362]) exists between concurrent operations performed by the Updater and actions a local unprivileged process can trigger. The Updater runs with elevated privileges to modify Chrome installation files, which places it outside the browser sandbox. When the Updater performs file operations, permission checks, or process handling without adequate synchronization, an attacker can interleave operations to manipulate the Updater into acting on attacker-controlled resources. Exploitation results in code execution in the Updater's privilege context, effectively bypassing the Chrome sandbox that normally contains renderer and browser process compromises.

Root Cause

The root cause is insufficient synchronization in the Updater's handling of shared resources on Windows. Concurrent access to files, handles, or registry keys creates a Time-of-Check to Time-of-Use (TOCTOU) window. An attacker who wins this race can substitute legitimate resources with malicious ones between validation and use.

Attack Vector

Exploitation requires local access and the ability to execute a program on the target host. The attacker runs a local program that races with Updater operations to swap files or manipulate paths at precisely timed moments. No user interaction is required, and no prior authentication to the Updater service is needed. Because attack complexity is high, exploitation depends on winning a narrow timing window, but successful exploitation yields sandbox escape with high impact to confidentiality, integrity, and availability.

Refer to the Chromium Issue Tracker Entry for additional technical context on the affected code paths.

Detection Methods for CVE-2026-87467

Indicators of Compromise

Unexpected file creation or replacement in the Chrome installation directory (%ProgramFiles%\Google\Chrome\Application\) by non-Updater processes
Unusual child processes spawned by GoogleUpdate.exe or the Chrome Updater service
Symbolic link or junction creation targeting Chrome Updater working directories from user-writable paths

Detection Strategies

Monitor process creation events where the Chrome Updater executes binaries not signed by Google
Correlate rapid file handle operations against Chrome Updater paths with process creation events from unprivileged users
Alert on privilege escalation patterns where a low-integrity process is followed by high-integrity code execution referencing Updater artifacts

Monitoring Recommendations

Enable Windows Sysmon Event ID 11 (FileCreate) and Event ID 1 (ProcessCreate) with rules covering Chrome Updater directories
Track Chrome version telemetry across the fleet to identify hosts running builds below 153.0.8010.36
Review authenticated vulnerability scan output regularly for endpoints reporting outdated Chrome installations

How to Mitigate CVE-2026-87467

Immediate Actions Required

Update Google Chrome on all Windows endpoints to version 153.0.8010.36 or later
Verify the Chrome Updater service is running the patched version and has completed a successful update cycle
Restrict local logon rights on shared workstations to reduce the pool of users capable of executing local exploits

Patch Information

Google released the fix in the stable channel update for desktop. Administrators should confirm deployment by checking chrome://settings/help on managed endpoints or by querying installed version data through endpoint management tooling. Full details are in the Chrome Desktop Update Announcement.

Workarounds

No official workaround exists; patching to 153.0.8010.36 or later is required
As a temporary measure, restrict interactive access to Windows systems where Chrome cannot be immediately updated
Enforce application control policies to prevent execution of unapproved binaries by standard users

bash

# Verify Chrome version on Windows endpoints via PowerShell
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion