CVE-2026-87492: Google Chrome DevTools RCE Vulnerability

CVE-2026-87492 Overview

CVE-2026-87492 is an incorrect authorization vulnerability in the DevTools component of Google Chrome prior to version 153.0.8010.36. A remote attacker can potentially execute arbitrary code outside the browser sandbox by convincing a user to visit a crafted HTML page. The flaw is tracked under CWE-863: Incorrect Authorization and was addressed in the Chrome Stable channel update published by Google. Chromium rates the internal severity as High, and the CVSS scope change reflects impact beyond the vulnerable component into the host operating system.

Critical Impact
Successful exploitation escapes the Chrome renderer sandbox, giving an attacker arbitrary code execution on the user's system after a single visit to a malicious page.

Affected Products

Google Chrome (Desktop) versions prior to 153.0.8010.36
Chromium-based builds sharing the vulnerable DevTools code path
All supported desktop platforms (Windows, macOS, Linux) running affected Chrome builds

Discovery Timeline

2026-09-09 - CVE-2026-87492 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87492

Vulnerability Analysis

The vulnerability resides in Chrome DevTools, the browser's built-in developer and debugging interface. DevTools exposes privileged APIs that normal web content should never reach. An authorization check fails to correctly validate the caller's origin or privilege level, allowing untrusted web content to invoke functionality reserved for the DevTools frontend.

Because DevTools operates with elevated privileges relative to a standard renderer, misuse of its interfaces can bridge the boundary between web content and the host. Exploitation requires user interaction, such as loading a crafted HTML page, and results in a scope change where code runs outside the sandbox.

Google addressed the issue in the Chrome Stable channel update. Additional engineering context is tracked in Chromium Issue #529123409.

Root Cause

The defect is an incorrect authorization check [CWE-863] within DevTools. Privileged endpoints do not properly verify that the requesting context is a trusted DevTools frontend, permitting attacker-controlled pages to invoke restricted functionality.

Attack Vector

An attacker hosts a crafted HTML page and lures a target to visit it. The page issues requests that reach the improperly authorized DevTools surface, chaining to arbitrary code execution outside the Chrome sandbox. No credentials are required, and the attack originates over the network.

No public proof-of-concept is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-87492

Indicators of Compromise

Chrome processes spawning unexpected child processes such as cmd.exe, powershell.exe, or shell interpreters immediately after browsing activity
Outbound network connections from Chrome renderer or utility processes to unrecognized hosts serving HTML with heavy DevTools protocol references
New persistence artifacts (scheduled tasks, run keys, LaunchAgents) created by a Chrome process tree

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build earlier than 153.0.8010.36
Alert on browser processes writing executable content to disk or invoking script interpreters, which is anomalous for typical browsing sessions
Correlate DevTools protocol traffic (chrome-devtools://, devtools:// scheme usage) originating from unexpected origins

Monitoring Recommendations

Ingest endpoint process telemetry into a centralized data lake and baseline normal Chrome child-process behavior
Monitor web proxy and DNS logs for repeated user visits to newly registered domains preceding suspicious endpoint activity
Track Chrome auto-update status through management tooling to confirm the patched build has rolled out fleet-wide

How to Mitigate CVE-2026-87492

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all desktop endpoints
Restart the browser after update to ensure the patched binary is active, since Chrome applies updates only on relaunch
Verify enterprise policy is not pinning Chrome to a vulnerable version and remove any such pinning

Patch Information

Google released the fix in the Chrome Stable channel. See the Stable Channel Update for Desktop advisory for release notes and the associated Chromium tracking entry at Chromium Issue #529123409.

Workarounds

Restrict user browsing to trusted sites through web filtering until patch deployment is complete
Disable or restrict DevTools access via enterprise policy DeveloperToolsAvailability where feasible
Enforce site isolation and standard sandboxing policies; do not run Chrome with --no-sandbox

bash

# Verify Chrome version on Linux/macOS
google-chrome --version

# Windows: enforce DevTools restrictions via Group Policy registry key
# HKLM\SOFTWARE\Policies\Google\Chrome\DeveloperToolsAvailability = 2
#   (2 = DeveloperToolsDisallowed)
reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v DeveloperToolsAvailability /t REG_DWORD /d 2 /f