Skip to main content
OneCon26: Gain the advantage in the AI era. Oct. 20–22 in Las Vegas.Register Now
Vulnerability Database/CVE-2026-87475

CVE-2026-87475: Google Chrome Omnibox Auth Bypass Vulnerability

CVE-2026-87475 is an authorization bypass flaw in Google Chrome Omnibox that allows attackers to access privileged pages through social engineering. This post covers technical details, affected versions, and mitigation.

Published:

CVE-2026-87475 Overview

CVE-2026-87475 is a missing authorization vulnerability [CWE-862] in the Omnibox component of Google Chrome. The flaw affects versions of Chrome prior to 153.0.8010.36. A remote attacker who convinces a user to interact with a crafted HTML page can bypass system access restrictions and reach a privileged page. Google's Chromium project rated the security severity as Medium. The vulnerability requires user interaction through social engineering, which limits opportunistic exploitation but does not eliminate risk in targeted phishing campaigns.

Critical Impact

Successful exploitation lets an attacker cross a trust boundary from web content into a privileged Chrome page, expanding the browser's attack surface for follow-on abuse.

Affected Products

  • Google Chrome Desktop versions prior to 153.0.8010.36
  • Chromium-based browsers incorporating the vulnerable Omnibox code path
  • Stable channel builds distributed before the September 2026 update

Discovery Timeline

  • 2026-09-09 - CVE-2026-87475 published to the National Vulnerability Database
  • 2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87475

Vulnerability Analysis

The Omnibox is Chrome's combined address and search bar. It brokers navigation between web-origin content and internal chrome:// pages that carry elevated privileges. This vulnerability stems from an authorization check that is missing on a code path reachable through Omnibox-driven navigation. An attacker who lures a user to a crafted HTML page can trigger navigation into a privileged surface that should be gated behind stricter origin or user-gesture checks. Because privileged Chrome pages expose sensitive browser functionality, crossing this boundary broadens the impact of otherwise contained web content.

Root Cause

The root cause is a missing authorization control [CWE-862] on an Omnibox navigation path. The affected code accepts a request to reach a privileged destination without verifying that the caller holds the required permission or that the required user intent is present. Google addressed the defect in Chrome 153.0.8010.36.

Attack Vector

Exploitation is remote but requires social engineering. The attacker hosts or delivers a crafted HTML page and persuades the target to load it in a vulnerable Chrome build. The page then invokes the Omnibox code path that bypasses the access restriction, landing execution or navigation on a privileged page. Full technical details are tracked in Chromium Issue #507225626 and the Google Chrome Release Update.

No public proof-of-concept code has been released, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS model places exploitation probability at the lower end of the distribution.

Detection Methods for CVE-2026-87475

Indicators of Compromise

  • Chrome browser telemetry showing navigation events targeting chrome:// internal URLs that originate from web-content frames
  • Endpoint logs recording Chrome processes below version 153.0.8010.36 visiting untrusted external HTML pages followed by internal page loads
  • Web proxy or DNS logs correlating user visits to newly registered domains with subsequent Chrome anomaly signals

Detection Strategies

  • Inventory Chrome installations across the estate and flag any build below 153.0.8010.36 as exposed
  • Alert on suspicious redirects from web pages to Chrome internal surfaces using browser or endpoint telemetry
  • Correlate phishing email delivery with subsequent Chrome navigation activity to identify social engineering chains

Monitoring Recommendations

  • Track Chrome version distribution through enterprise management tooling and enforce minimum version policy
  • Ingest browser event logs into a centralized analytics pipeline for cross-user correlation of unusual navigation patterns
  • Monitor threat intelligence feeds for public proof-of-concept code referencing CVE-2026-87475 or Chromium Issue 507225626

How to Mitigate CVE-2026-87475

Immediate Actions Required

  • Update Google Chrome to version 153.0.8010.36 or later on all managed desktops
  • Restart browser sessions after update to ensure the patched binary is loaded
  • Communicate phishing awareness guidance to users, emphasizing risk from unsolicited links

Patch Information

Google released the fix in the Chrome Stable channel update documented in the Google Chrome Release Update. Chromium-based browsers should adopt the corresponding upstream patch tracked in Chromium Issue #507225626.

Workarounds

  • Enforce automatic Chrome updates through enterprise policy to close the exposure window
  • Restrict browsing to trusted sites via web filtering where feasible until patching completes
  • Disable or restrict Omnibox suggestions from untrusted sources through group policy where operational needs allow
bash
# Verify installed Chrome version on Windows
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Verify installed Chrome version on Linux
google-chrome --version

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.

Experience the Most Advanced Cybersecurity Platform

See how the world’s most intelligent, autonomous cybersecurity platform can protect your organization today and into the future.

Try SentinelOne