CVE-2026-87490 Overview
CVE-2026-87490 is an information disclosure vulnerability in the Transactions Platform component of Google Chrome. Versions prior to 153.0.8010.36 allow a remote attacker to obtain sensitive information by convincing a user to visit a crafted HTML page. The flaw is categorized under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Chromium engineers assigned the underlying issue a security severity of Low, while the National Vulnerability Database (NVD) rates it Medium. Exploitation requires user interaction and does not affect integrity or availability.
Critical Impact
A remote attacker can exfiltrate sensitive browser-managed data from the Transactions Platform when a victim loads attacker-controlled HTML content.
Affected Products
- Google Chrome versions prior to 153.0.8010.36 (Stable channel, Desktop)
- Chromium-based browsers embedding vulnerable Transactions Platform code
- Enterprise Chrome deployments not updated to the latest Stable channel
Discovery Timeline
- 2026-09-09 - CVE-2026-87490 published to the National Vulnerability Database
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-87490
Vulnerability Analysis
The vulnerability resides in the Transactions Platform component of Google Chrome, which handles payment- and transaction-related workflows in the browser. A crafted HTML page can trigger conditions that cause the component to expose sensitive information to the page context. The disclosed data crosses a trust boundary intended to isolate browser-managed transaction data from arbitrary web content. Exploitation is network-reachable and requires the victim to render attacker-supplied HTML, typically via a link or embedded iframe. There is no requirement for authentication or elevated privileges on the target system.
Root Cause
The root cause is improper restriction of access to sensitive information within the Transactions Platform, consistent with [CWE-200]. Public technical detail is limited because the Chromium Issue Tracker entry #533112829 remains restricted pending broad patch adoption. Google has not published exploitation specifics in the Chrome Stable channel update.
Attack Vector
An attacker hosts or injects a crafted HTML page and induces a victim to load it in an unpatched Chrome instance. When the Transactions Platform processes elements on the page, it leaks sensitive information back into the DOM or a script context controlled by the attacker. The attacker then exfiltrates the leaked data over the network. No verified proof-of-concept is publicly available and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.
No verified exploit code is publicly available. See the Chromium Issue Tracker entry #533112829 for future technical detail once access restrictions are lifted.
Detection Methods for CVE-2026-87490
Indicators of Compromise
- Chrome browser processes on endpoints reporting versions earlier than 153.0.8010.36 after the patch release window
- Outbound HTTP or HTTPS requests to newly registered or low-reputation domains immediately after page loads containing transaction-related iframes
- Unexpected form submissions or fetch calls originating from pages hosting embedded payment widgets
Detection Strategies
- Inventory installed Chrome versions across managed endpoints and flag any build below 153.0.8010.36
- Correlate browser telemetry with network egress logs to identify anomalous data transfers following visits to untrusted sites
- Monitor endpoint process telemetry for Chrome renderer processes loading suspicious HTML from phishing campaigns
Monitoring Recommendations
- Enable browser version reporting through Chrome Enterprise Core or equivalent management tooling
- Ingest DNS and proxy logs into a centralized analytics platform to hunt for exfiltration patterns tied to transaction workflows
- Alert on Chrome update failures or endpoints that skip auto-update cycles
How to Mitigate CVE-2026-87490
Immediate Actions Required
- Update Google Chrome to version 153.0.8010.36 or later on all Windows, macOS, and Linux endpoints
- Restart Chrome after the update to ensure the patched binaries load in all renderer processes
- Verify that Chrome auto-update is enabled and functioning across the fleet
Patch Information
Google addressed CVE-2026-87490 in the Stable channel update documented in the Chrome Releases blog post for desktop. Upgrade to Chrome 153.0.8010.36 or later. Chromium-based browsers should apply the corresponding vendor updates once available.
Workarounds
- Restrict user browsing to trusted sites using enterprise web filtering until patches are deployed
- Deploy Chrome enterprise policies to block or sandbox third-party payment iframes on high-risk endpoints
- Educate users to avoid clicking untrusted links, since the attack requires loading crafted HTML content
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.