CVE-2026-87476 Overview
CVE-2026-87476 is an incorrect authorization vulnerability [CWE-863] in the Loader component of Google Chrome. Versions prior to 153.0.8010.36 are affected. A remote attacker can obtain sensitive information by convincing a user to visit a crafted HTML page. Google classifies the Chromium security severity as Medium.
The flaw requires user interaction, such as loading an attacker-controlled web page, but does not require authentication or elevated privileges. Successful exploitation exposes information handled by the browser's Loader, which coordinates resource fetching and cross-origin decisions.
Critical Impact
Remote attackers can leak sensitive browser-managed data across security boundaries through a single crafted web page, undermining same-origin protections.
Affected Products
- Google Chrome (Desktop) versions prior to 153.0.8010.36
- Chromium-based builds incorporating the vulnerable Loader component
- Downstream browsers packaging pre-patch Chromium releases
Discovery Timeline
- 2026-09-09 - CVE-2026-87476 published to NVD
- 2026-09-09 - Last updated in NVD database
- 2026-09 - Google releases Stable Channel update fixing the issue
Technical Details for CVE-2026-87476
Vulnerability Analysis
The vulnerability resides in Chrome's Loader, the subsystem responsible for issuing network requests, applying fetch policies, and enforcing cross-origin access rules. An authorization check within the Loader does not correctly gate access to a resource or response attribute. This allows an attacker-controlled document to reach data that should be restricted by origin, mode, or credential policy.
Exploitation requires a user to open or be redirected to a crafted HTML page. The page triggers the flawed code path in the Loader and reads back sensitive information from the response or from the browser's internal state. Confidentiality is affected while integrity and availability are not.
Root Cause
The root cause is an incorrect authorization decision [CWE-863] inside the Loader. The check evaluates a request or response against the wrong policy state, permitting access that same-origin or fetch metadata rules would otherwise deny. Refer to the Chromium Issue Tracker Entry for upstream details.
Attack Vector
The attack vector is network-based and requires user interaction. An attacker hosts a crafted page and lures a victim to visit it through phishing, malvertising, or a compromised site. Once loaded, the page issues fetches that exploit the Loader's authorization gap. See the Google Chrome Desktop Update for the vendor's release notes.
No verified public proof-of-concept exists at time of writing. The Chromium issue tracker entry may remain restricted until a majority of users have updated.
Detection Methods for CVE-2026-87476
Indicators of Compromise
- Chrome browser processes reporting a version string earlier than 153.0.8010.36 in enterprise inventory
- User navigation logs showing visits to unfamiliar domains immediately preceding anomalous outbound requests from the browser process
- Unexpected cross-origin fetch patterns originating from renderer processes to third-party endpoints
Detection Strategies
- Inventory installed Chrome versions across managed endpoints and flag hosts below 153.0.8010.36
- Correlate browser telemetry with web proxy logs to identify pages that trigger unusual resource loading behavior
- Monitor for renderer processes making requests to endpoints that respond with sensitive JSON, tokens, or authenticated content shortly after visiting untrusted sites
Monitoring Recommendations
- Enable Chrome Enterprise reporting to centralize version and extension telemetry
- Ingest browser and proxy logs into a SIEM for correlation with threat intelligence feeds
- Alert on outbound requests from browser processes to newly registered or low-reputation domains
How to Mitigate CVE-2026-87476
Immediate Actions Required
- Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints
- Restart browser sessions after patch deployment to ensure the fix loads
- Verify Chromium-based third-party browsers have shipped equivalent updates before allowing use
Patch Information
Google addressed the issue in the Stable Channel update documented in the Google Chrome Desktop Update. Enterprises using managed deployments should push the update through Chrome Browser Cloud Management, Group Policy, or their standard software distribution tooling.
Workarounds
- Restrict browsing to trusted domains via web proxy allow-lists until patching completes
- Deploy security awareness reminders warning users against opening unsolicited links
- Enforce Chrome auto-update policies to prevent version drift on managed devices
# Verify installed Chrome version on Linux/macOS endpoints
google-chrome --version
# Windows: query the version via registry
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
