CVE-2026-87508: Google Chrome Authorization Bypass Vulnerability

CVE-2026-87508 Overview

CVE-2026-87508 is an incorrect authorization vulnerability in the Loader component of Google Chrome. The flaw exists in versions prior to Chrome 153.0.8010.36 and allows a remote attacker to bypass web origin policy through a crafted HTML page. Google's Chromium project rates the severity as Medium. The vulnerability requires user interaction, meaning a victim must visit or interact with an attacker-controlled page. Successful exploitation permits cross-origin information access that the browser's security model normally prevents [CWE-863].

Critical Impact
Attackers can bypass same-origin protections in Chrome's Loader to access resources across web origins, exposing users to targeted information disclosure via malicious web pages.

Affected Products

Google Chrome versions prior to 153.0.8010.36
Chromium-based browsers sharing the affected Loader component
Desktop stable channel builds for Windows, macOS, and Linux

Discovery Timeline

2026-09-09 - CVE-2026-87508 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87508

Vulnerability Analysis

The vulnerability resides in Chrome's Loader component, which handles resource fetching and enforces origin-based security decisions. The Loader performs an incorrect authorization check when evaluating whether a resource request complies with the web origin policy. This flaw enables a crafted HTML page to trigger a code path that bypasses cross-origin restrictions. The result is unauthorized access to content that should be isolated between origins under the browser's same-origin model.

Exploitation is network-based and requires user interaction, such as loading a malicious page or clicking a crafted link. The impact is limited to confidentiality, with no integrity or availability effects. This aligns with the CWE-863: Incorrect Authorization weakness class.

Root Cause

The root cause is a missing or misapplied authorization check inside the Loader's resource decision logic. Chrome's origin policy enforcement did not correctly gate certain load paths, allowing a request to proceed against a resource in another origin. Full technical details are tracked in the Chromium Issue Tracker entry.

Attack Vector

An attacker hosts a crafted HTML page and lures a victim to load it in a vulnerable Chrome build. The page constructs specific resource loads that exercise the flawed authorization path in the Loader. When the browser processes these loads, it returns or exposes cross-origin content to attacker-controlled script context. No authentication or elevated privileges are required on the target system.

No public proof-of-concept code has been released. The vulnerability is described in prose in the Chrome Blog update announcement.

Detection Methods for CVE-2026-87508

Indicators of Compromise

Chrome browser telemetry showing versions earlier than 153.0.8010.36 in the environment
Outbound requests to unfamiliar domains immediately followed by cross-origin resource fetches
Browser process activity loading HTML pages referenced in phishing or malvertising campaigns

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag builds below 153.0.8010.36
Monitor web proxy and DNS logs for user navigation to suspicious or newly registered domains
Correlate browser child-process activity with anomalous network patterns suggesting data exfiltration

Monitoring Recommendations

Enable browser version reporting through enterprise management platforms such as Chrome Browser Cloud Management
Ingest browser and endpoint telemetry into a centralized data lake for cross-source correlation
Track user interaction alerts triggered by known phishing infrastructure and web filtering categories

How to Mitigate CVE-2026-87508

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all desktop platforms
Restart the browser after applying the update so patched Loader code is loaded into memory
Verify auto-update policies are enforced and not disabled by group policy or user configuration

Patch Information

Google released the fix in the stable channel update documented in the Chrome Blog Update Announcement. Administrators should deploy Chrome 153.0.8010.36 or later. Chromium-based browser vendors typically ship the same fix within days of the upstream release, so verify vendor advisories for Edge, Brave, Opera, and Vivaldi.

Workarounds

Restrict browsing to trusted sites through web filtering until patches are deployed
Enable Enhanced Safe Browsing in Chrome to add heuristic protection against malicious pages
Educate users about phishing links and require caution when following external URLs

bash

# Verify Chrome version on Linux/macOS
google-chrome --version

# Windows: check installed version via registry
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv