CVE-2026-87498: Google Chrome Auth Bypass Vulnerability

CVE-2026-87498 Overview

CVE-2026-87498 is a missing authorization vulnerability [CWE-862] in the WebUI component of Google Chrome prior to version 153.0.8010.36. An attacker who has already compromised the renderer process can bypass the web origin policy by delivering a crafted HTML page. Chromium engineers rated the internal severity as High, while the NVD assigned a lower base score because exploitation requires both a prior renderer compromise and user interaction. Successful abuse allows a sandboxed renderer to interact with privileged WebUI surfaces that should be gated by origin checks.

Critical Impact
A compromised renderer can bypass web origin enforcement and reach WebUI functionality that is normally restricted to trusted Chrome-internal origins.

Affected Products

Google Chrome for Desktop prior to 153.0.8010.36
Chromium-based browsers sharing the affected WebUI code path
Chrome Stable channel builds released before the September 2026 desktop update

Discovery Timeline

2026-09-09 - CVE-2026-87498 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87498

Vulnerability Analysis

The flaw lives in Chrome's WebUI layer, the internal framework that powers privileged pages such as chrome://settings and other browser-internal surfaces. WebUI endpoints normally enforce that only trusted chrome:// origins can call their handlers. This vulnerability stems from a missing authorization check that fails to reject requests originating from a non-privileged web origin once the renderer has been compromised. As a result, an attacker who already controls a renderer process can reach WebUI-exposed functionality across origin boundaries.

The vulnerability is not directly exploitable from an untrusted web page alone. It functions as a second-stage primitive in a browser exploit chain, typically paired with a prior renderer-side memory corruption or type confusion bug. Once chained, it enables the attacker to bypass same-origin protections that would otherwise contain the compromised renderer.

Root Cause

The root cause is an absent or incomplete authorization check inside a WebUI handler, mapped to [CWE-862] Missing Authorization. Chrome's WebUI bindings expect all IPC-exposed methods to validate that the caller originates from a permitted internal scheme. The affected handler did not enforce this check, allowing crafted messages from a compromised renderer to satisfy the interface without meeting the origin requirement.

Attack Vector

Exploitation requires a network-delivered HTML payload and user interaction with the malicious page. The attacker must already have achieved renderer compromise through a separate vulnerability. From that foothold, the crafted page issues requests to the WebUI surface that are accepted despite originating outside the trusted chrome:// origin. Refer to the Chromium Issue Tracker entry #552413517 for upstream technical detail.

No public proof-of-concept, exploit code, or CISA KEV listing has been recorded for this issue as of publication.

Detection Methods for CVE-2026-87498

Indicators of Compromise

Chrome processes rendering untrusted content that subsequently issue IPC calls targeting WebUI handlers outside expected user workflows.
Endpoints running Chrome builds earlier than 153.0.8010.36 after the patch release window.
Unexpected navigations or subframe loads referencing chrome:// URLs initiated from web content.

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any host running a build older than 153.0.8010.36.
Correlate browser crash telemetry and renderer sandbox escapes with subsequent WebUI activity, since this bug is a chain component.
Monitor proxy and DNS logs for delivery of HTML payloads from newly registered or low-reputation domains targeting Chrome users.

Monitoring Recommendations

Track Chrome auto-update compliance through enterprise management tooling such as Chrome Browser Cloud Management.
Alert on process behavior where chrome.exe renderer children spawn unexpected child processes or write to sensitive user profile locations.
Ingest browser and endpoint telemetry into a centralized analytics platform to correlate exploitation attempts across the fleet.

How to Mitigate CVE-2026-87498

Immediate Actions Required

Update Google Chrome Desktop to version 153.0.8010.36 or later on all Windows, macOS, and Linux endpoints.
Restart browser sessions after patch deployment to ensure the vulnerable WebUI code is unloaded.
Audit Chromium-based downstream browsers for equivalent patched builds before considering the issue resolved.

Patch Information

Google released a fix in the Stable channel update announced in the Google Chrome Desktop Update advisory. The fix is included in Chrome 153.0.8010.36 and later. Enterprise administrators should validate distribution through their standard Chrome update channel and confirm the version string on managed endpoints.

Workarounds

No vendor-supplied workaround exists; upgrading to the patched version is the supported remediation.
Enforce site isolation and keep the Chrome sandbox enabled to raise the cost of the prerequisite renderer compromise.
Restrict browsing to trusted sites through enterprise policy and web filtering while patch rollout is in progress.

bash

# Verify Chrome version on Linux/macOS endpoints
google-chrome --version
# Expected output: Google Chrome 153.0.8010.36 or later

# Windows: query installed version via registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version