CVE-2026-87469 Overview
CVE-2026-87469 is an improper input validation vulnerability [CWE-20] in the Extensions component of Google Chrome prior to version 153.0.8010.36. A remote attacker can bypass the web origin policy and reach a privileged page by sending crafted network traffic. Google classifies the underlying Chromium security severity as Low.
Exploitation requires the victim to interact with attacker-controlled network content while an affected Chrome build is running. Successful abuse enables cross-origin access into privileged browser contexts that are normally isolated from web pages.
Critical Impact
Remote attackers can bypass the same-origin boundary and interact with a privileged Chrome page through crafted network traffic, breaking a core browser trust boundary.
Affected Products
- Google Chrome for Desktop prior to 153.0.8010.36
- Chromium-based browsers incorporating the affected Extensions code
- Downstream distributions that repackage vulnerable Chrome builds
Discovery Timeline
- 2026-09-09 - CVE-2026-87469 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-87469
Vulnerability Analysis
The flaw resides in Chrome's Extensions subsystem, which mediates communication between web content, extension contexts, and privileged browser pages. Improper input validation allows attacker-controlled data delivered over the network to influence extension routing decisions.
As a result, a remote attacker can push content across the web-origin boundary and into a privileged page. Privileged pages in Chrome expose APIs and UI surfaces that web origins are explicitly forbidden from touching, which is why an origin-policy bypass into that context is a meaningful trust-boundary violation even at a Low Chromium severity rating.
The vulnerability is tracked as an input validation weakness [CWE-20]. Public references, including Chromium Issue #538715523 and the Google Chrome Stable Update, document the fix but do not publish exploit details.
Root Cause
The Extensions component fails to fully validate fields carried in network-delivered content before honoring them in origin or navigation decisions. The missing checks let untrusted input traverse a code path intended only for trusted callers, collapsing the separation between web origins and privileged Chrome pages.
Attack Vector
A remote attacker delivers crafted network traffic that Chrome's Extensions logic processes without adequate validation. When a user loads or interacts with the malicious content, the browser routes the request into a privileged page context, bypassing web-origin restrictions. No authentication is required, and the attack occurs entirely through normal browsing activity.
No public proof-of-concept, exploit code, or evidence of in-the-wild exploitation has been published. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.22%.
Detection Methods for CVE-2026-87469
Indicators of Compromise
- Chrome browser processes loading unexpected chrome:// or other privileged page resources immediately after visiting an untrusted external site.
- Extension processes generating outbound network requests to domains that do not match any installed extension's declared host permissions.
- Renderer-to-browser IPC anomalies correlated with newly rendered privileged UI surfaces.
Detection Strategies
- Inventory Chrome versions across managed endpoints and flag any build earlier than 153.0.8010.36.
- Monitor browser telemetry for navigation events that transition from a web origin directly into a privileged internal page.
- Correlate proxy and DNS logs with endpoint browser activity to spot crafted responses targeting extension endpoints.
Monitoring Recommendations
- Ingest Chrome enterprise reporting events into the SIEM and alert on version drift below the patched build.
- Track extension installation and update events, focusing on sideloaded or developer-mode extensions.
- Baseline normal privileged-page usage per host so deviations trigger investigation.
How to Mitigate CVE-2026-87469
Immediate Actions Required
- Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints.
- Restart Chrome after the update so the patched binaries are actually loaded.
- Validate that Chromium-based browsers in the environment have absorbed the upstream fix.
Patch Information
Google addressed the issue in the Chrome Stable channel release documented in the Google Chrome Stable Update advisory. The fix is tracked in Chromium Issue #538715523. Administrators should deploy Chrome 153.0.8010.36 or later through their standard software distribution mechanism.
Workarounds
- Restrict installation of unreviewed extensions through Chrome enterprise policy until patching is complete.
- Enforce automatic Chrome updates via ChromeUpdate or MDM configuration to reduce version drift.
- Route browser traffic through a filtering proxy that blocks known malicious destinations while rollout is in progress.
# Verify installed Chrome version on Linux/macOS endpoints
google-chrome --version
# Windows: query the installed version from the registry
reg query "HKLM\SOFTWARE\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.