CVE-2026-87477: Google Chrome Information Disclosure Flaw

CVE-2026-87477 Overview

CVE-2026-87477 is an information disclosure vulnerability in the Core component of Google Chrome prior to version 153.0.8010.36. A remote attacker can leak sensitive information by convincing a user to visit a crafted HTML page. The Chromium project classified the underlying issue as low severity, while the NVD scoring reflects a higher potential confidentiality impact. The weakness is tracked under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
A remote attacker can exfiltrate sensitive in-process data from Chrome by luring a user to a malicious web page, without requiring privileges or prior authentication.

Affected Products

Google Chrome (Desktop) versions prior to 153.0.8010.36
Chromium-based browsers that share the affected Core component and have not integrated the upstream fix
Managed Chrome deployments on Windows, macOS, and Linux running vulnerable Stable channel builds

Discovery Timeline

2026-09-09 - CVE-2026-87477 published to NVD following the Google Chrome Stable channel update
2026-09-09 - Last updated in the NVD database

Technical Details for CVE-2026-87477

Vulnerability Analysis

The flaw resides in the Core module of Chrome, which handles central browser functionality shared across renderer and browser processes. A crafted HTML page can trigger conditions that expose sensitive information to an attacker-controlled origin. Because the attack requires only that a victim load a malicious page, exploitation scales through phishing links, malvertising, and compromised sites. The Chromium project rated the security severity as Low, indicating the leaked data is bounded rather than a full memory disclosure primitive. However, information leaks in Core often serve as building blocks for chained exploits, particularly to bypass Address Space Layout Randomization (ASLR) or to profile the victim environment before delivering a second-stage payload.

Root Cause

The root cause is categorized as [CWE-200], an exposure of sensitive information to an unauthorized actor. The Core component fails to enforce a boundary that would prevent attacker-supplied content from reading state it should not access. Full technical detail is restricted in the Chromium Issue Tracker #540059211 pending broad patch adoption.

Attack Vector

Exploitation occurs over the network and requires user interaction, typically navigation to a malicious page. No authentication or elevated privileges are needed. An attacker embeds the trigger in HTML or JavaScript delivered from any origin the victim visits, including through an iframe on a compromised third-party site. The vulnerability manifests during normal page rendering; no additional plugins or extensions are required. See the Google Chrome Stable channel advisory for vendor-confirmed details.

Detection Methods for CVE-2026-87477

Indicators of Compromise

Chrome browser processes reporting version strings earlier than 153.0.8010.36 in endpoint inventory telemetry
Outbound HTTPS beacons from renderer processes to newly registered or low-reputation domains shortly after user navigation
HTML documents containing anomalous script patterns that probe browser internals or timing side channels

Detection Strategies

Query endpoint telemetry for installed Chrome versions and flag any host running a build below 153.0.8010.36
Correlate web proxy logs with threat intelligence feeds to identify user navigation to domains hosting suspected exploit pages
Monitor for unusual renderer-process network activity that deviates from a user's normal browsing profile

Monitoring Recommendations

Ingest browser version data and DNS or proxy logs into a centralized analytics platform for cross-source correlation
Alert on Chrome installations that fall behind the current Stable channel release by more than one minor version
Track user click-through on phishing URLs identified by email security gateways and correlate with subsequent browser activity

How to Mitigate CVE-2026-87477

Immediate Actions Required

Update all Google Chrome installations to version 153.0.8010.36 or later on Windows, macOS, and Linux
Restart Chrome after updates to ensure the patched binary is loaded in every active user session
Audit Chromium-based browsers and embedded WebViews in the environment for equivalent fixed builds

Patch Information

Google addressed the issue in Chrome Stable 153.0.8010.36. Administrators should reference the Google Chrome Stable channel update and confirm rollout through enterprise update mechanisms such as Chrome Browser Cloud Management, Group Policy, or MDM. Additional context is available in the Chromium Issue Tracker #540059211.

Workarounds

Enforce enterprise policies that block navigation to uncategorized or newly registered domains until patch deployment completes
Deploy security awareness reminders warning users against clicking unsolicited links during the remediation window
Where feasible, restrict high-risk user groups to isolated browsing sessions or remote browser isolation until updates are verified

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Force update check via Chrome policy on managed Windows hosts
reg add "HKLM\Software\Policies\Google\Update" /v UpdateDefault /t REG_DWORD /d 1 /f

# macOS: trigger Google Software Update to pull the patched build
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent -runMode oneshot