CVE-2026-87493 Overview
CVE-2026-87493 is a missing authorization vulnerability in the FileSystem component of Google Chrome prior to version 153.0.8010.36. The flaw allows a remote attacker to bypass system access restrictions by convincing a user to visit a crafted HTML page. Exploitation requires social engineering, so attacker success depends on user interaction with attacker-controlled web content. Google Chromium rates the security severity as Medium. The weakness is classified under CWE-862: Missing Authorization.
Critical Impact
A successful attack lets a remote actor circumvent FileSystem access controls in Chrome, potentially reaching resources the browser sandbox is designed to protect.
Affected Products
- Google Chrome desktop builds prior to 153.0.8010.36
- Chromium-based browsers that ship the vulnerable FileSystem component before the corresponding patch
- Chrome Stable channel for Windows, macOS, and Linux prior to the September 2026 stable update
Discovery Timeline
- 2026-09-09 - CVE-2026-87493 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-87493
Vulnerability Analysis
The vulnerability resides in Chrome's FileSystem implementation, which mediates access between web content and browser-managed storage. A missing authorization check permits a crafted HTML page to reach FileSystem operations that should be gated behind stronger access restrictions. The flaw does not require authentication and is reachable over the network via a browser visit. Exploitation depends on user interaction, so attackers must lure targets to a malicious page through phishing, malvertising, or compromised sites. The Exploit Prediction Scoring System (EPSS) data lists a low near-term exploitation probability, but browser bugs with social-engineering vectors are commonly folded into commodity attack chains after disclosure.
Root Cause
The root cause is an absent or insufficient authorization check ([CWE-862]) in the FileSystem code path. Chrome grants access to protected FileSystem functionality without validating that the requesting origin or context holds the required permission. The trust boundary between untrusted web content and privileged browser storage APIs is not enforced consistently.
Attack Vector
An attacker hosts a crafted HTML page and drives a target to visit it. When the page loads, it issues FileSystem calls that reach the unguarded code path. Because the authorization check is missing, Chrome performs the operation and the attacker bypasses restrictions the FileSystem layer is supposed to enforce. Additional detail is available in the Google Chrome Stable Update advisory and Chromium Issue #523741272.
No verified proof-of-concept code is publicly available. Refer to the vendor advisory for authoritative technical details.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-87493
Indicators of Compromise
- Chrome browser processes on endpoints running versions earlier than 153.0.8010.36 after the patch release date
- Outbound HTTP or HTTPS requests to newly registered or low-reputation domains hosting HTML content followed by unusual local file activity
- Phishing emails or messaging lures that direct users to click a link and open it specifically in Chrome
Detection Strategies
- Inventory installed Chrome versions across the fleet and flag any host below 153.0.8010.36 as exposed
- Correlate browser process telemetry with subsequent child process spawns, file writes to user profile directories, or persistence attempts
- Monitor web proxy and DNS logs for user navigation to domains flagged by threat intelligence feeds as social-engineering infrastructure
Monitoring Recommendations
- Ingest Chrome update and version telemetry into a centralized log platform to track patch compliance over time
- Alert on Chrome renderer or utility processes accessing unexpected paths on the local file system
- Enable browser management policies that report installed version and channel to security teams
How to Mitigate CVE-2026-87493
Immediate Actions Required
- Update Google Chrome to version 153.0.8010.36 or later on all Windows, macOS, and Linux endpoints
- Restart Chrome after the update so the patched binaries are loaded on every managed host
- Verify managed Chromium-based browsers have pulled the corresponding upstream fix
Patch Information
Google released the fix in the Chrome Stable channel update announced on the Chrome Releases blog. The corresponding upstream tracker is Chromium Issue #523741272. Deploying Chrome 153.0.8010.36 or later remediates the missing authorization check in the FileSystem component.
Workarounds
- Enforce enterprise browser policies that block navigation to uncategorized or newly registered domains until endpoints are patched
- Deliver targeted user awareness reminders about not opening unsolicited links, since exploitation requires social engineering
- Where possible, restrict use of the FileSystem API through enterprise policy until the update is fully deployed
# Verify installed Chrome version on Linux endpoints
google-chrome --version
# Windows: query installed version from the registry
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
