CVE-2026-87479 Overview
CVE-2026-87479 is an insufficient policy enforcement vulnerability in the Extensions component of Google Chrome prior to version 153.0.8010.36. The flaw allows a remote attacker who has already compromised the renderer process to escape the Chrome sandbox and execute arbitrary code on the host. Exploitation requires social engineering to trick the user into interacting with a crafted HTML page. Google has classified the Chromium security severity as Medium, while NVD assigns a higher score reflecting the potential impact of a sandbox escape. The weakness is tracked as [CWE-807] (reliance on untrusted inputs in a security decision).
Critical Impact
Successful exploitation chains a compromised renderer with policy bypass in Extensions to achieve arbitrary code execution outside the Chrome sandbox on the victim host.
Affected Products
- Google Chrome Desktop versions prior to 153.0.8010.36
- Chromium-based browsers sharing the same Extensions policy enforcement code
- Windows, macOS, and Linux Chrome Stable channel builds
Discovery Timeline
- 2026-09-09 - CVE-2026-87479 published to the National Vulnerability Database
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-87479
Vulnerability Analysis
The vulnerability resides in the Extensions subsystem of Google Chrome. Policy checks that gate extension-related privileged operations are insufficient, allowing an attacker who controls a compromised renderer to bypass isolation boundaries. When combined with user interaction on a crafted HTML page, the attacker can execute arbitrary code outside the sandbox. The attack requires two prerequisites: prior renderer compromise and successful social engineering, which raises exploitation complexity. The impact is significant because it undermines the sandbox, the primary defense boundary in Chrome's multi-process architecture. A successful chain grants the attacker code execution in a higher-privilege browser process context.
Root Cause
The root cause is insufficient enforcement of extension policies at a trust boundary between the renderer and the browser process. Because the browser process trusts inputs or state that a compromised renderer can influence, an attacker can direct extension-mediated behavior in ways the security model does not intend. This aligns with [CWE-807], where a security decision depends on assumptions that hostile code can violate.
Attack Vector
Exploitation requires a network-reachable attacker to first compromise the Chrome renderer process, typically via a separate memory-safety or logic bug. The attacker then serves a crafted HTML page that requires user interaction, such as a click or navigation, to trigger the policy bypass in Extensions. The scope changes because code that should be confined to the renderer sandbox executes in the more privileged browser context. No authentication is required.
No verified public exploit is available. See the Chromium Issue Tracker entry for additional technical detail once access restrictions are lifted.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-87479
Indicators of Compromise
- Chrome browser processes spawning unexpected child processes such as command interpreters or scripting hosts outside normal update workflows.
- Unsigned or newly installed extensions appearing in user profiles without administrator approval.
- Outbound network connections from Chrome to attacker-controlled domains immediately following user interaction with a suspicious page.
Detection Strategies
- Inventory Chrome versions across the fleet and flag hosts running builds earlier than 153.0.8010.36.
- Monitor extension installation events in Chrome enterprise telemetry and correlate against approved allowlists.
- Alert on renderer-to-browser process anomalies, including unexpected process trees rooted at chrome.exe.
Monitoring Recommendations
- Ingest Chrome enterprise reporting logs and browser telemetry into a centralized data lake for cross-host correlation.
- Track EPSS movement for CVE-2026-87479; current EPSS is 0.345% and may shift if a public proof-of-concept emerges.
- Review web proxy logs for user visits to newly registered domains hosting HTML content followed by unusual endpoint activity.
How to Mitigate CVE-2026-87479
Immediate Actions Required
- Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints.
- Force browser restarts to ensure the patched binary is loaded across user sessions.
- Audit installed extensions and remove any that are unapproved or unnecessary.
Patch Information
Google addressed the issue in the Chrome Stable channel update announced in the Google Chrome Desktop Update advisory. Enterprise administrators should deploy the update via Chrome Browser Cloud Management, Group Policy, or their standard software distribution pipeline. Chromium-based browser vendors should confirm they have merged the corresponding upstream fix.
Workarounds
- Enforce an extension allowlist via ExtensionInstallAllowlist and ExtensionInstallBlocklist policies to reduce attack surface.
- Restrict browsing to trusted destinations using web filtering to reduce the likelihood of social engineering delivery.
- Educate users to avoid interacting with unsolicited pages that request unusual clicks or extension prompts.
# Configuration example: enforce Chrome update and extension policy on Windows via registry
reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v "TargetVersionPrefix" /t REG_SZ /d "153.0.8010.36" /f
reg add "HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallBlocklist" /v "1" /t REG_SZ /d "*" /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
