CVE-2026-87485: Google Chrome CORS Auth Bypass Vulnerability

CVE-2026-87485 Overview

CVE-2026-87485 is an incorrect authorization vulnerability in the Cross-Origin Resource Sharing (CORS) implementation of Google Chrome prior to version 153.0.8010.36. An attacker who has already compromised the renderer process can bypass web origin policy through a crafted HTML page. Chromium classifies the security severity as Medium, while the assigned CVSS 3.1 score reflects a lower base rating due to the required prerequisite compromise and user interaction. The flaw maps to CWE-863: Incorrect Authorization.

Critical Impact
A remote attacker with a compromised renderer process can bypass the same-origin policy enforced through CORS, potentially reading cross-origin resources that should be protected by browser sandboxing.

Affected Products

Google Chrome versions prior to 153.0.8010.36
Chromium-based browsers sharing the affected CORS logic
Desktop Stable channel builds on Windows, macOS, and Linux

Discovery Timeline

2026-09-09 - CVE-2026-87485 published to NVD
2026-09-09 - Last updated in NVD database
2026-09 - Google releases Stable channel update addressing the issue (Chrome Releases)

Technical Details for CVE-2026-87485

Vulnerability Analysis

The vulnerability resides in Chrome's CORS enforcement path. CORS is the browser mechanism that decides whether a page from one origin may read responses from another origin. Incorrect authorization logic in this path allows a compromised renderer to request and process cross-origin data that the policy should have blocked.

Exploitation requires two conditions. First, the attacker must already control the renderer process, typically through a prior sandboxed code execution flaw. Second, a victim must load a crafted HTML page that triggers the flawed CORS decision. The chained nature raises attack complexity and limits confidentiality impact to a single scope.

Root Cause

The defect is an authorization check failure in the CORS module rather than a memory safety bug. The browser fails to correctly validate the origin authorization state before returning or exposing a cross-origin response to the renderer. Details are tracked in Chromium Issue #499230506.

Attack Vector

The attack vector is network-based and requires user interaction to visit attacker-controlled content. Because the renderer must already be compromised, the vulnerability is most useful as a second-stage primitive in an exploit chain. An adversary would use it to widen access after breaking the renderer sandbox, reading resources such as authenticated API responses from other origins the user is signed into.

No public proof-of-concept, exploit code, or CISA KEV listing exists for this CVE at publication time. Refer to the Chromium Issue Tracker entry for technical details as they become public after the standard restriction window.

Detection Methods for CVE-2026-87485

Indicators of Compromise

Chrome browser versions reporting as older than 153.0.8010.36 in enterprise inventory
Anomalous cross-origin HTTP requests originating from browsers where preceding renderer exploitation is suspected
Unexpected access patterns to authenticated third-party endpoints from user browsing sessions

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag builds below 153.0.8010.36
Correlate browser process anomalies (child process spawning, unexpected network egress) with subsequent cross-origin data access
Monitor web application server logs for CORS preflight and actual requests carrying unusual Origin headers from user agents matching vulnerable Chrome versions

Monitoring Recommendations

Ingest browser and endpoint telemetry into a centralized data lake to correlate renderer process behavior with network activity
Track Chrome update compliance as a continuous metric rather than a point-in-time check
Alert on renderer processes making outbound requests to sensitive internal origins outside of expected user workflows

How to Mitigate CVE-2026-87485

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints
Force-restart Chrome after deployment so the patched binary is loaded into memory
Validate version compliance through endpoint management tooling before closing remediation tickets

Patch Information

Google addressed the vulnerability in the Stable channel update documented at Chrome Releases. Enterprises using managed deployment through Google Admin Console, Group Policy, or third-party patch management should push the update through existing rollout rings. Chromium-based browsers that incorporate upstream fixes will receive equivalent patches on their vendor schedules.

Workarounds

Prioritize patching endpoints handling sensitive authenticated web sessions such as SaaS admin consoles
Reduce exposure to precursor renderer exploits by enabling Chrome Site Isolation and Enhanced Safe Browsing where feasible
Restrict browsing to trusted origins on privileged workstations until patch deployment completes

bash

# Verify Chrome version on Linux/macOS endpoints
google-chrome --version

# Windows: query installed version via registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# Expected output: 153.0.8010.36 or later