CVE-2026-87471 Overview
CVE-2026-87471 is an incorrect authorization vulnerability [CWE-863] in the ServiceWorker component of Google Chrome. Versions prior to 153.0.8010.36 fail to properly enforce authorization checks, allowing a remote attacker who has already compromised the renderer process to bypass site isolation using a crafted HTML page. Google's Chromium security team rated the issue Medium severity. The flaw undermines one of Chrome's core sandboxing boundaries, potentially exposing cross-origin content to attacker-controlled code.
Critical Impact
An attacker with a compromised renderer process can bypass Chrome's site isolation boundary through crafted HTML, enabling cross-origin data access that site isolation is designed to prevent.
Affected Products
- Google Chrome versions prior to 153.0.8010.36 (Stable channel, Desktop)
- Chromium-based browsers incorporating the vulnerable ServiceWorker code paths
- Downstream distributions that ship the affected Chromium version
Discovery Timeline
- 2026-09-09 - CVE CVE-2026-87471 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-87471
Vulnerability Analysis
The vulnerability resides in Chrome's ServiceWorker implementation, which handles background scripts intercepting network requests for a given origin. ServiceWorker is a privileged web platform primitive that must strictly enforce origin boundaries so one site cannot control the response lifecycle for another. In affected Chrome builds, an authorization check is missing or improperly applied when the ServiceWorker interacts with resources across process boundaries. This weakness lets a compromised renderer manipulate ServiceWorker behavior in ways site isolation is meant to block.
Site isolation exists specifically to contain renderer compromises. When authorization gaps appear in cross-process browser components like ServiceWorker, the containment guarantee weakens. Exploitation depends on prior renderer compromise, typically achieved by chaining a separate memory corruption or logic bug in the rendering engine.
Root Cause
The root cause is an incorrect authorization check [CWE-863] within ServiceWorker request or client handling. The component does not adequately verify that the requesting principal is entitled to the target cross-origin resource before proceeding. Refer to Chromium Issue Tracker #498869663 for the upstream engineering details.
Attack Vector
Exploitation requires two stages. First, the attacker compromises the renderer process, typically via an unrelated bug triggered by a malicious page. Second, the attacker serves a crafted HTML page that leverages the ServiceWorker authorization flaw to reach data or capabilities belonging to another site. See the Google Chrome Stable Update advisory for release notes.
No verified public exploit code is available for CVE-2026-87471. The vulnerability mechanism is described in prose only; consult the linked Chromium issue for authoritative technical detail once access restrictions are lifted.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-87471
Indicators of Compromise
- Chrome browser processes running versions earlier than 153.0.8010.36 on managed endpoints.
- Unexpected ServiceWorker registrations from domains unrelated to the user's browsing activity.
- Anomalous cross-origin fetches originating from ServiceWorker contexts recorded in browser telemetry.
Detection Strategies
- Inventory installed Chrome versions across the estate and flag any host below 153.0.8010.36.
- Monitor endpoint telemetry for renderer process crashes or exploitation precursors that could enable a chained attack.
- Correlate web proxy logs with browser telemetry to identify suspicious HTML payloads targeting ServiceWorker APIs.
Monitoring Recommendations
- Enable browser management policies that report installed browser versions to a central console.
- Alert on new ServiceWorker registrations delivered from low-reputation or newly registered domains.
- Track outbound requests from browser child processes for cross-origin patterns inconsistent with normal user activity.
How to Mitigate CVE-2026-87471
Immediate Actions Required
- Update Google Chrome to 153.0.8010.36 or later on all Windows, macOS, and Linux endpoints.
- Restart browser sessions after patching to ensure the vulnerable ServiceWorker code is unloaded from memory.
- Validate Chromium-based third-party browsers for a corresponding upstream security update.
Patch Information
Google addressed the issue in Chrome Stable 153.0.8010.36. Deployment details and channel information are published in the Google Chrome Stable Update advisory. Enterprise administrators should push the update through existing browser management tooling and verify version compliance on all managed devices.
Workarounds
- No vendor-supplied workaround exists; patching is the only supported remediation.
- Restrict browsing to trusted sites via enterprise policy until the update is deployed.
- Consider disabling ServiceWorker registration through group policy in high-risk environments as a temporary hardening measure.
# Verify installed Chrome version on Linux endpoints
google-chrome --version
# Example enterprise policy check (Windows) via registry
reg query "HKLM\SOFTWARE\Policies\Google\Chrome\Update" /v UpdateDefault
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
