CVE-2026-87487 Overview
CVE-2026-87487 is a missing authorization vulnerability [CWE-862] in the FileSystem component of Google Chrome. The flaw affects Chrome versions prior to 153.0.8010.36 on desktop. A remote attacker who has already compromised the renderer process can leverage social engineering through a crafted HTML page to escape the sandbox. Successful exploitation may lead to arbitrary code execution outside the browser sandbox on the victim host. Google's Chromium project rates the underlying security severity as Medium, while the National Vulnerability Database scores it higher due to the combined impact and scope change.
Critical Impact
Sandbox escape leading to arbitrary code execution on the host, chained from a compromised renderer and user interaction with an attacker-controlled page.
Affected Products
- Google Chrome for Desktop versions prior to 153.0.8010.36
- Chromium-based browsers using the vulnerable FileSystem component
- Downstream distributions that embed Chromium releases predating the September 2026 Stable update
Discovery Timeline
- 2026-09-09 - CVE-2026-87487 published to the National Vulnerability Database
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-87487
Vulnerability Analysis
The vulnerability resides in Chrome's FileSystem implementation. The component fails to enforce an authorization check on a privileged operation reachable from the renderer process. An attacker who already controls the renderer can invoke this operation to reach resources or interfaces intended to be gated by the browser process. When chained with user interaction on a crafted HTML page, the missing check allows execution to escape the renderer sandbox boundary. The result is arbitrary code execution in a higher-privilege context on the victim system. Exploitation requires two conditions: prior compromise of the renderer and successful social engineering of the user. This raises attack complexity but does not eliminate real-world risk for targeted users.
Root Cause
The root cause is a missing authorization control [CWE-862] in the FileSystem code path. Chrome's sandbox model assumes that sensitive filesystem operations enforce browser-side checks before honoring renderer requests. The vulnerable code accepts a request that should have been validated against the caller's origin and permission state.
Attack Vector
Exploitation is network-based and requires user interaction with a crafted HTML page. The attacker must first compromise the renderer process, typically through a separate memory corruption or logic flaw, then trigger the missing authorization path. Because the scope changes when the sandbox is escaped, impact extends to resources beyond the initially compromised component.
See the Chromium Issue Tracker Entry and the Google Chrome Stable Update for further technical context. No public proof-of-concept code has been released.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-87487
Indicators of Compromise
- Chrome renderer processes spawning unexpected child processes or writing to sensitive filesystem locations outside profile directories
- Browser telemetry showing crashes in the FileSystem component followed by new process creation under the Chrome parent
- Outbound connections from Chrome to previously unseen domains immediately preceding local process anomalies
Detection Strategies
- Inventory endpoints running Chrome versions earlier than 153.0.8010.36 using software asset management or endpoint telemetry
- Alert on Chrome child processes executing shell interpreters, script hosts, or LOLBins that are inconsistent with normal browsing behavior
- Correlate user reports of suspicious page prompts with subsequent process or file activity on the same host
Monitoring Recommendations
- Enable process lineage and file-write telemetry from browser processes and forward it to a central analytics platform
- Monitor for enterprise policy drift that disables Chrome auto-update or extends the update deferral window
- Track Chrome Stable channel release notes and align vulnerability management SLAs to browser advisories
How to Mitigate CVE-2026-87487
Immediate Actions Required
- Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints
- Restart Chrome after the update completes to ensure the patched binaries are loaded into memory
- Verify Chromium-based third-party browsers have pulled the corresponding upstream fix
Patch Information
Google addressed the issue in the Chrome Stable channel release documented in the Google Chrome Stable Update advisory. Administrators should confirm that endpoints report a Chrome version of 153.0.8010.36 or higher. Managed environments using Chrome Browser Cloud Management or group policy should validate that auto-update is enabled and unblocked at the network layer.
Workarounds
- No vendor-supplied workaround exists; apply the patched Chrome build as the primary remediation
- Restrict browsing to trusted sites and enforce user awareness training focused on unexpected browser prompts until patching completes
- Consider deploying browser isolation for high-risk user populations to reduce exposure during the patch rollout window
# Verify installed Chrome version on Windows, macOS, and Linux endpoints
# Windows (PowerShell)
(Get-Item "$env:ProgramFiles\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion
# macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version
# Linux
google-chrome --version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
