CVE-2026-87495: Google Chrome Information Disclosure Vulnerability

CVE-2026-87495 Overview

CVE-2026-87495 is an information disclosure vulnerability in the Scroll component of Google Chrome prior to version 153.0.8010.36. A remote attacker who has already compromised the renderer process can leak cross-origin data by serving a crafted HTML page. The Chromium project rated the security severity as Medium.

The flaw undermines the same-origin policy enforced by the browser, allowing content from one origin to be observed by an attacker-controlled context. Exploitation requires user interaction, such as visiting a malicious or compromised page. The vulnerability is tracked under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
An attacker who has compromised the renderer can bypass cross-origin restrictions and exfiltrate sensitive data rendered by other origins in the same browser session.

Affected Products

Google Chrome for Desktop prior to 153.0.8010.36
Chromium-based browsers that incorporate the vulnerable Scroll implementation
Downstream distributions bundling pre-153 Chrome builds

Discovery Timeline

2026-09-09 - CVE-2026-87495 published to NVD
2026-09-09 - Last updated in NVD database
2026-09 - Fixed in Google Chrome Stable channel via the Stable Channel Update for Desktop

Technical Details for CVE-2026-87495

Vulnerability Analysis

The vulnerability resides in Chrome's Scroll component, which handles scroll position, scroll-linked events, and related layout state. Under specific conditions, the component exposes state derived from cross-origin content back to a script context that should not observe it. This breaks the origin isolation boundary that Chrome enforces between documents.

Because the flaw requires a pre-compromised renderer process, it is most useful as a follow-on primitive rather than an initial-access bug. An attacker who already achieved script execution or renderer compromise can chain this leak to read data from other origins loaded in the same process.

Root Cause

The root cause maps to CWE-200, information exposure. The Scroll code path returns or exposes values that reflect cross-origin document state without applying the origin checks required to preserve site isolation. Chrome's Site Isolation is intended to keep documents from different sites in different renderer processes, but implementation gaps in scroll-related APIs can still leak measurable state.

Attack Vector

Exploitation proceeds over the network and requires user interaction, typically the victim loading an attacker-controlled page. The attacker first needs a foothold in the renderer process. From there, the attacker uses a crafted HTML page that triggers the Scroll code path in a way that reveals cross-origin data such as content dimensions, scroll offsets, or other side-channel signals tied to another origin. No verified public proof-of-concept has been published for this issue. See the Chromium Issue #517122234 tracker for technical detail as it becomes available.

Detection Methods for CVE-2026-87495

Indicators of Compromise

Browser telemetry showing Chrome desktop clients running versions earlier than 153.0.8010.36 after the stable channel update was released.
Outbound network traffic from browser processes to unfamiliar domains immediately after a user visited an untrusted page.
Renderer process crashes or sandbox anomalies preceding suspicious script activity, consistent with a prior renderer compromise stage.

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build below 153.0.8010.36.
Correlate web proxy logs with endpoint browser telemetry to identify users who accessed newly registered or low-reputation domains hosting crafted HTML.
Hunt for anomalous cross-origin data access patterns in web application logs, such as unexpected read patterns tied to authenticated sessions.

Monitoring Recommendations

Ingest browser update state and process telemetry into a centralized data lake to enforce version compliance.
Monitor for renderer process anomalies, including unexpected child processes or code injection attempts, which are prerequisites for exploiting this flaw.
Alert on user reports of unexpected authentication prompts or session artifacts, which can indicate cross-origin data leakage.

How to Mitigate CVE-2026-87495

Immediate Actions Required

Update Google Chrome to 153.0.8010.36 or later on all managed endpoints.
Restart browsers after deployment to ensure the patched binary is loaded into memory.
Audit Chromium-based applications and embedded browser frameworks for the vulnerable version and update accordingly.

Patch Information

Google released the fix in the Chrome Stable channel. Refer to the Google Chrome Stable Update advisory for release notes and the full list of security fixes. Enterprises using managed Chrome deployments should validate that automatic updates are enabled through the ChromeCleanupEnabled and update-related administrative policies.

Workarounds

Enforce strict site isolation policies and disable non-essential browser features that expand renderer attack surface.
Restrict access to untrusted websites through web filtering or DNS-layer controls until patching is complete.
Advise users to avoid clicking unsolicited links and to close browser sessions containing sensitive workflows before browsing unknown sites.

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Windows: query installed version via registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version