Skip to main content
A Leader in the 2026 Gartner® Magic Quadrant™ for Endpoint Protection. Six years running.Find Out Why
Vulnerability Database/CVE-2026-87473

CVE-2026-87473: Google Chrome Auth Bypass Vulnerability

CVE-2026-87473 is an authorization bypass flaw in Google Chrome FileHandling that enables attackers to circumvent system access restrictions through social engineering tactics. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

Published:

CVE-2026-87473 Overview

CVE-2026-87473 is an incorrect authorization vulnerability [CWE-863] in the FileHandling component of Google Chrome. Versions prior to 153.0.8010.36 fail to enforce system access restrictions when processing crafted HTML content. A remote attacker leveraging social engineering can trick users into visiting a malicious page that bypasses these restrictions. Google's Chromium security team rated the flaw as Low severity. The issue was resolved in the Stable channel update for desktop.

Critical Impact

Successful exploitation allows a remote attacker to bypass system access restrictions through a crafted HTML page, requiring user interaction via social engineering.

Affected Products

  • Google Chrome for Desktop prior to 153.0.8010.36
  • Chromium-based browsers incorporating the vulnerable FileHandling component
  • Downstream distributions that ship the affected Chrome/Chromium build

Discovery Timeline

  • 2026-09-09 - CVE CVE-2026-87473 published to NVD
  • 2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87473

Vulnerability Analysis

The vulnerability resides in Chrome's FileHandling subsystem, which mediates how the browser interacts with local files and system resources. FileHandling did not correctly evaluate authorization before permitting certain operations initiated from web content. An attacker who convinces a user to load a crafted HTML page can leverage this gap to reach resources that browser policy should have blocked. The bug is tracked in Chromium as issue #537101736 and was addressed in Chrome 153.0.8010.36. Because exploitation requires user interaction and social engineering, the practical attack surface is narrower than a fully remote flaw.

Root Cause

The root cause is an incorrect authorization check [CWE-863] within the FileHandling code path. The component performs an access decision that does not fully validate the origin, user consent state, or resource scope before granting access. This allows web content to reach operations that should require stronger authorization gates.

Attack Vector

Exploitation is remote and requires user interaction. An attacker hosts a crafted HTML page and lures a target to visit or interact with it, often through phishing, malvertising, or a compromised site. Once loaded, the page issues requests through the FileHandling path that the browser incorrectly authorizes. Refer to the Chromium Issue Tracker #537101736 and the Google Chrome Stable Update for release-level detail. No public proof-of-concept exploit is available at time of publication.

Detect Identity Attacks the Moment Authentication Fails

Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.

Stop Identity Attacks

Detection Methods for CVE-2026-87473

Indicators of Compromise

  • Chrome browser processes on endpoints reporting versions earlier than 153.0.8010.36
  • Browser telemetry showing unexpected file handler invocations following visits to untrusted domains
  • Endpoint alerts for file access or launch events triggered from browser child processes shortly after HTML page loads

Detection Strategies

  • Inventory installed Chrome versions across managed endpoints and flag any build below 153.0.8010.36
  • Correlate web proxy logs with endpoint file activity to identify pages that immediately precede unusual file handler invocations
  • Hunt for social engineering lures, such as pages instructing users to click or confirm file-open prompts

Monitoring Recommendations

  • Enable browser update telemetry and alert on hosts that fall behind the current Stable channel release
  • Monitor process ancestry for chrome.exe spawning file handler processes with unexpected arguments
  • Ingest browser and endpoint logs into a centralized analytics platform to correlate page loads with subsequent file activity

How to Mitigate CVE-2026-87473

Immediate Actions Required

  • Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints
  • Force-restart Chrome after deployment to ensure the patched binary is loaded
  • Verify enterprise policy pushes and confirm auto-update is enabled across the fleet

Patch Information

Google released the fix in the Chrome Stable channel update documented in the Google Chrome Stable Update release notes. Administrators should deploy Chrome 153.0.8010.36 or later. Chromium-based browsers should apply the equivalent upstream fix once vendors publish updated builds.

Workarounds

  • Restrict browsing to trusted sites through URL filtering while patch deployment is in progress
  • Deliver user awareness reminders about social engineering lures that request file-open interactions
  • Disable or restrict Chrome file handler registrations via enterprise policy where operationally feasible
bash
# Verify installed Chrome version on Windows endpoints
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Verify installed Chrome version on Linux
google-chrome --version

Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.

Experience the Most Advanced Cybersecurity Platform

See how the world’s most intelligent, autonomous cybersecurity platform can protect your organization today and into the future.

Try SentinelOne