Skip to main content
OneCon26: Gain the advantage in the AI era. Oct. 20–22 in Las Vegas.Register Now
Vulnerability Database/CVE-2026-87509

CVE-2026-87509: Google Chrome RCE Vulnerability

CVE-2026-87509 is a remote code execution flaw in Google Chrome Updater on Windows that allows local attackers to execute code outside the sandbox. This post explains the technical details, affected versions, impact, and mitigation steps.

Published:

CVE-2026-87509 Overview

CVE-2026-87509 is an incorrect authorization vulnerability [CWE-863] in the Updater component of Google Chrome on Windows. The flaw affects Chrome versions prior to 153.0.8010.36. A local attacker can leverage a local program to execute arbitrary code outside the Chrome sandbox. The Chromium project rates the underlying security severity as Low, while NVD scores the CVE as High due to the sandbox escape impact. Successful exploitation grants code execution at the privilege level of the Updater service, bypassing the browser's sandbox boundary.

Critical Impact

Local attackers can escape the Chrome sandbox and execute arbitrary code on Windows systems by abusing improper authorization checks in the Chrome Updater.

Affected Products

  • Google Chrome on Windows prior to 153.0.8010.36
  • Microsoft Windows (host operating system)
  • Google Chrome Updater component

Discovery Timeline

Technical Details for CVE-2026-87509

Vulnerability Analysis

The vulnerability resides in the Google Chrome Updater on Windows. The Updater runs as a privileged service responsible for keeping Chrome current across user sessions. Improper authorization checks allow a local program to interact with the Updater in ways it should not permit. This interaction leads to code execution outside the Chrome renderer sandbox. Because the Updater operates with elevated trust, the attacker gains the ability to run arbitrary code in a context that a sandboxed process could not otherwise reach. The flaw is classified under [CWE-863] Incorrect Authorization.

Root Cause

The Chrome Updater performs authorization decisions that fail to correctly validate the caller. A local program can invoke Updater functionality without meeting the intended trust requirements. This authorization gap enables an attacker with local access to trigger update-related code paths that execute code outside sandbox restrictions.

Attack Vector

Exploitation requires local access to a Windows host running a vulnerable Chrome build. An attacker executes a local program that communicates with the Updater and abuses the flawed authorization logic. The attack complexity is high, and no user interaction is required. Successful exploitation results in arbitrary code execution outside the Chrome sandbox, breaking a core browser security boundary.

No public proof-of-concept or exploit code is available at the time of publication. Refer to Chromium Issue #535718578 for the upstream tracking record.

Detection Methods for CVE-2026-87509

Indicators of Compromise

  • Unexpected child processes spawned by the Google Chrome Updater service (GoogleUpdater.exe or related Updater binaries) outside scheduled update windows.
  • Local processes issuing inter-process communication (IPC) to the Updater from non-browser code paths.
  • New or modified files under the Chrome Updater installation directory not attributable to a legitimate update.

Detection Strategies

  • Monitor process ancestry for anomalous parent-child relationships involving the Chrome Updater on Windows endpoints.
  • Alert on Chrome installations reporting versions prior to 153.0.8010.36 through endpoint inventory data.
  • Correlate local privilege escalation telemetry with Updater activity to identify sandbox-escape behavior.

Monitoring Recommendations

  • Enable command-line and process-creation logging on Windows endpoints to capture Updater invocation context.
  • Track Chrome browser version drift across the fleet and flag any host running a build below 153.0.8010.36.
  • Review scheduled tasks and services associated with Google Update for unauthorized modifications.

How to Mitigate CVE-2026-87509

Immediate Actions Required

  • Update Google Chrome on Windows to version 153.0.8010.36 or later on every managed endpoint.
  • Verify that the Chrome Updater service is running and permitted to complete automatic updates.
  • Inventory endpoints for outdated Chrome installations and prioritize remediation for multi-user or shared hosts.

Patch Information

Google addressed the issue in Chrome Stable 153.0.8010.36 for Windows. Details are published in the Google Chrome Stable Update release notes. Deploy the patched build through enterprise management tooling or by allowing the Chrome Updater to apply the update automatically.

Workarounds

  • Restrict local user access on shared Windows systems to reduce the population of accounts that could execute a local exploit.
  • Apply application control policies that block untrusted local programs from interacting with the Chrome Updater.
  • Where patching is delayed, monitor Updater IPC and process creation events closely until the fixed build is deployed.
bash
# Verify installed Chrome version on Windows via PowerShell
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.FileVersion

# Confirm the reported version is 153.0.8010.36 or later

Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.

Experience the Most Advanced Cybersecurity Platform

See how the world’s most intelligent, autonomous cybersecurity platform can protect your organization today and into the future.

Try SentinelOne