CVE-2026-87468: Google Chrome Site Isolation Bypass

CVE-2026-87468 Overview

CVE-2026-87468 is an incorrect authorization vulnerability in the Isolated component of Google Chrome. The flaw affects Chrome versions prior to 153.0.8010.36 and allows a remote attacker to bypass site isolation using a crafted HTML page. Site isolation is a core Chrome security boundary that separates content from different origins into distinct renderer processes. A bypass weakens the browser's defense-in-depth against cross-origin data theft and Spectre-class side-channel attacks. Chromium rates this issue as Medium severity and tracks the root cause under CWE-863: Incorrect Authorization.

Critical Impact
A remote attacker can bypass Chrome's site isolation protections by serving a crafted HTML page, weakening origin-based security boundaries in the renderer.

Affected Products

Google Chrome Desktop versions prior to 153.0.8010.36
Chromium-based browsers sharing the pre-patch Isolated component
Downstream distributions packaging vulnerable Chrome builds

Discovery Timeline

2026-09-09 - CVE-2026-87468 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87468

Vulnerability Analysis

The vulnerability resides in the Isolated component of Google Chrome, which enforces site isolation policies at the process and origin boundary. An authorization check in this component does not correctly validate whether a requesting context is permitted to access resources belonging to another site. A crafted HTML page can exploit this gap remotely without requiring elevated privileges.

Site isolation exists to prevent cross-origin data exposure and to contain renderer compromises. When authorization decisions are made incorrectly, an attacker-controlled page can reach content or capabilities that should be scoped to a different origin. The result is a weakening of Chrome's origin-based security model rather than direct code execution.

Chromium classifies the issue as Medium severity. The Chromium Issue Report #532931962 tracks the underlying bug, and the fix ships in Chrome 153.0.8010.36 via the Google Chrome Desktop Update.

Root Cause

The root cause is an incorrect authorization check ([CWE-863]) inside the Isolated component. The component evaluates access decisions using logic that fails to enforce the intended site isolation boundary for specific request patterns triggered by a crafted document.

Attack Vector

Exploitation requires a victim to load an attacker-controlled or attacker-influenced HTML page. No authentication is required. Delivery paths include phishing links, malicious advertisements, and compromised websites serving the crafted content. Successful exploitation bypasses site isolation and may expose cross-origin data that would otherwise be inaccessible to the loaded document.

No verified public exploit code is available. See the Chromium Issue Report for upstream details.

Detection Methods for CVE-2026-87468

Indicators of Compromise

Chrome browser processes reporting version strings below 153.0.8010.36 in enterprise inventory data.
Unexpected cross-origin resource reads or renderer behavior anomalies observed via browser telemetry.
User navigation to unfamiliar domains immediately preceding anomalous renderer activity.

Detection Strategies

Inventory Chrome versions across managed endpoints and flag hosts running builds earlier than 153.0.8010.36.
Correlate web proxy or DNS logs against threat intelligence feeds to identify visits to known malicious landing pages.
Monitor endpoint telemetry for Chrome renderer processes exhibiting anomalous network requests to unrelated origins.

Monitoring Recommendations

Enable centralized Chrome update reporting through Chrome Browser Cloud Management or equivalent enterprise tooling.
Ingest browser and endpoint telemetry into a centralized data lake to support cross-source correlation of renderer activity and user navigation.
Alert on Chrome installations that fail to update within your patch service-level window.

How to Mitigate CVE-2026-87468

Immediate Actions Required

Update Chrome to version 153.0.8010.36 or later on all managed endpoints.
Force a browser restart after update deployment to ensure the patched Isolated component is loaded.
Audit Chromium-based browsers in the environment and apply vendor updates that incorporate the upstream fix.

Patch Information

Google addressed the vulnerability in Chrome Stable channel version 153.0.8010.36. Deployment details are published in the Google Chrome Desktop Update advisory. Chromium-based browser vendors typically incorporate upstream security fixes into their next release; confirm patched builds with each vendor.

Workarounds

Restrict browsing to trusted sites via enterprise web filtering until patching completes.
Enforce strict Content Security Policy (CSP) headers on internal applications to reduce cross-origin exposure.
Disable execution of untrusted third-party scripts and advertisements at the network gateway where feasible.

bash

# Verify Chrome version on Windows endpoints
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# Verify Chrome version on macOS/Linux
google-chrome --version

# Force Chrome update via policy (Windows registry example)
# Set update policy to "Always allow updates" for Chrome application ID
reg add "HKLM\SOFTWARE\Policies\Google\Update" /v UpdateDefault /t REG_DWORD /d 1 /f