CVE-2026-87511: Google Chrome DevTools Auth Bypass Flaw

CVE-2026-87511 Overview

CVE-2026-87511 is a missing authorization vulnerability in the DevTools component of Google Chrome. The flaw affects Chrome versions prior to 153.0.8010.36 and allows a remote attacker to obtain cross-origin data through a crafted Chrome extension. Google's Chromium team rated the security severity as Low. The issue is tracked under CWE-862: Missing Authorization.

Exploitation requires the target to install a malicious extension, which then abuses DevTools functionality to read data from origins the extension should not access. This breaks the same-origin boundary that browsers rely on to isolate web content.

Critical Impact
A malicious Chrome extension can bypass same-origin restrictions through DevTools and exfiltrate cross-origin data from the victim's browsing session.

Affected Products

Google Chrome for Desktop versions prior to 153.0.8010.36
Chromium-based browsers that inherit the vulnerable DevTools code path
Chrome extension ecosystem interacting with the DevTools API

Discovery Timeline

2026-09-09 - CVE-2026-87511 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87511

Vulnerability Analysis

The vulnerability resides in Chrome's DevTools implementation, which exposes privileged debugging capabilities to extensions through the chrome.devtools APIs. DevTools operates with elevated privileges compared to standard web content because it must inspect and modify pages across origins.

An authorization check was missing on a DevTools code path. This allowed an extension using DevTools APIs to retrieve response data or resource content belonging to origins outside the extension's declared host permissions. The impact is confidentiality loss across the same-origin boundary.

Google's Chromium team classified the security severity as Low because exploitation requires user installation of a crafted extension. The EPSS score of 0.215% reflects a low probability of observed exploitation activity in the near term.

Root Cause

The root cause is an absent authorization check ([CWE-862]) in a DevTools handler. The handler served data to the calling extension without verifying that the extension's host permissions covered the target origin. See the Chromium Issue Tracker Entry for the upstream ticket.

Attack Vector

An attacker publishes or sideloads a crafted Chrome extension. Once installed, the extension invokes DevTools APIs to read cross-origin resources loaded in the victim's tabs. No additional privilege escalation is required beyond convincing the user to install the extension.

No verified proof-of-concept code has been published. Refer to the Chrome Releases Update for vendor detail on the fix.

Detection Methods for CVE-2026-87511

Indicators of Compromise

Chrome extensions requesting the devtools_page manifest key without a clear debugging use case
Extensions issuing unusual volumes of chrome.devtools.inspectedWindow or chrome.devtools.network API calls
Unexpected outbound network traffic from extension background service workers containing session content from unrelated origins

Detection Strategies

Audit installed Chrome extensions across managed endpoints and flag any using DevTools APIs from untrusted publishers
Compare Chrome browser versions to 153.0.8010.36 and identify hosts running vulnerable builds
Monitor extension update events and manifest permission changes that add DevTools capabilities

Monitoring Recommendations

Ingest browser telemetry and extension inventory data into a centralized analytics platform for cross-fleet review
Alert on new extension installations that declare DevTools access in enterprise environments
Track outbound HTTPS destinations initiated by extension processes for anomalous data volumes

How to Mitigate CVE-2026-87511

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints
Force-restart Chrome sessions after deployment to ensure the patched binaries are loaded
Review the enterprise extension allowlist and remove extensions that are not required for business operations

Patch Information

Google addressed CVE-2026-87511 in the Chrome Stable channel release documented in the Chrome Releases Update. Administrators should confirm rollout completion through Chrome Browser Cloud Management or equivalent update tooling. The Chromium fix commit is referenced in the Chromium Issue Tracker Entry.

Workarounds

Enforce an extension allowlist through the ExtensionInstallAllowlist and ExtensionInstallBlocklist policies
Block extensions that request DevTools capabilities using the ExtensionSettings policy with restricted permissions
Disable developer mode for end users through Chrome enterprise policy to prevent sideloading of unreviewed extensions

bash

# Configuration example
# Chrome enterprise policy JSON restricting extension permissions
{
  "ExtensionInstallBlocklist": ["*"],
  "ExtensionInstallAllowlist": [
    "<approved-extension-id-1>",
    "<approved-extension-id-2>"
  ],
  "ExtensionSettings": {
    "*": {
      "blocked_permissions": ["devtools", "debugger"],
      "installation_mode": "blocked"
    }
  },
  "DeveloperToolsAvailability": 2
}