CVE-2026-87499: Google Chrome Auth Bypass Vulnerability

CVE-2026-87499 Overview

CVE-2026-87499 is an incorrect authorization vulnerability [CWE-863] in the Network component of Google Chrome prior to version 153.0.8010.36. A remote attacker who has already compromised the renderer process can bypass site isolation by serving a crafted HTML page. Site isolation is a core Chromium security boundary that keeps content from different origins in separate processes. Bypassing it allows an attacker to read or influence data belonging to other sites within the browser. Chromium rates the security severity as High.

Critical Impact
An attacker who controls a renderer process can escape the site isolation boundary and access cross-origin data, undermining the browser's fundamental multi-origin security model.

Affected Products

Google Chrome for Desktop prior to 153.0.8010.36
Chromium-based browsers incorporating the vulnerable Network component
Downstream distributions bundling pre-153 Chromium builds

Discovery Timeline

2026-09-09 - CVE-2026-87499 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87499

Vulnerability Analysis

The flaw resides in Chrome's Network stack and involves an authorization check that fails to correctly enforce origin boundaries. Site isolation runs distinct sites in separate renderer processes and relies on the browser process to arbitrate cross-origin resource access. When the Network component performs incorrect authorization, a compromised renderer can request resources or actions associated with other sites and receive responses that should have been denied. The attack requires user interaction, meaning the victim must load a crafted HTML page delivered by the attacker. See the Google Chrome Stable Update announcement and the Chromium Issue Tracker entry #553118043 for vendor details.

Root Cause

The root cause is an incorrect authorization check [CWE-863] within the Network component. The affected code path does not fully validate that the requesting renderer is entitled to act on behalf of the target origin. This gap allows a renderer already under attacker control to issue requests that the browser process treats as authorized when they should be rejected under site isolation rules.

Attack Vector

Exploitation proceeds in two stages. First, the attacker must compromise a Chrome renderer process, typically by chaining a prior renderer bug. Second, the attacker serves a crafted HTML page that triggers the vulnerable Network authorization path. The result is a site isolation bypass exposing cross-origin data such as authenticated responses, cookies scoped to other sites, or in-memory resources belonging to a different origin. No elevated privileges are required beyond renderer compromise, and the attack is delivered over the network.

Detection Methods for CVE-2026-87499

Indicators of Compromise

Chrome browser processes running versions earlier than 153.0.8010.36 on managed endpoints.
Anomalous outbound requests originating from renderer processes to unrelated third-party origins immediately after visiting an unfamiliar page.
Unexpected cross-site data appearing in browser telemetry, error reports, or DevTools captures.

Detection Strategies

Inventory Chrome versions across the fleet using endpoint management or EDR telemetry and flag hosts below 153.0.8010.36.
Correlate browser process crash reports with visits to newly registered or low-reputation domains, which may indicate renderer exploitation attempts.
Monitor for renderer processes spawning atypical network activity patterns that deviate from user browsing baselines.

Monitoring Recommendations

Ingest Chrome update and version telemetry into a centralized data lake for continuous compliance reporting.
Alert on execution of Chrome binaries whose version strings match known-vulnerable builds after a patch deadline.
Track web proxy and DNS logs for repeated navigations to suspicious domains that coincide with browser instability events.

How to Mitigate CVE-2026-87499

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints.
Force-restart Chrome after deployment to ensure the patched binary is loaded into memory.
Audit Chromium-based browsers and embedded webviews in the environment for equivalent updates from their maintainers.

Patch Information

Google addressed the issue in the Chrome Stable channel with build 153.0.8010.36. Details are published in the Google Chrome Stable Update release notes and tracked in the Chromium Issue Tracker #553118043. Administrators should distribute the update through their standard browser management channel and validate installed versions post-deployment.

Workarounds

No vendor-supplied workaround exists; applying the patched build is the only supported remediation.
Restrict browsing to trusted destinations via enterprise web filtering until patch rollout completes.
Enforce Chrome enterprise policies that block untrusted extensions and reduce the attack surface exposed to renderer-level exploits.

bash

# Verify installed Chrome version on Windows, macOS, and Linux
# Windows (PowerShell)
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Linux
google-chrome --version

# Expected output: 153.0.8010.36 or later