CVE-2026-87513: Google Chrome Auth Bypass Vulnerability

CVE-2026-87513 Overview

CVE-2026-87513 is a missing authorization vulnerability [CWE-862] in the ControlledFrame component of Google Chrome. Versions prior to 153.0.8010.36 fail to properly enforce system access restrictions when handling requests originating from a crafted HTML page. A remote attacker leveraging social engineering can trick a user into visiting a malicious page and bypass access controls that ControlledFrame is intended to enforce. Google's Chromium team rated the security severity as Medium. The issue was resolved in the Chrome Stable channel update tracked in the Chromium issue tracker as #511773417.

Critical Impact
A remote attacker can bypass system access restrictions in Chrome by convincing a user to load a crafted HTML page, potentially exposing functionality that should require explicit authorization.

Affected Products

Google Chrome Desktop versions prior to 153.0.8010.36
Chromium-based browsers embedding the vulnerable ControlledFrame implementation
Applications and platforms that expose ControlledFrame (for example, ChromeOS Isolated Web Apps) prior to the fixed build

Discovery Timeline

2026-09-09 - CVE-2026-87513 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87513

Vulnerability Analysis

The flaw resides in ControlledFrame, the Chromium element used by Isolated Web Apps to embed and control third-party web content with elevated capabilities. Chrome fails to perform an authorization check before allowing certain operations exposed through ControlledFrame. The result is that content or actions gated behind system access restrictions can be reached without the required permission grant. Because the attacker must convince a victim to open a crafted HTML page, exploitation depends on social engineering rather than an unauthenticated network reachable service. Google addressed the defect in Chrome 153.0.8010.36.

Root Cause

The root cause is a missing authorization check [CWE-862] in the ControlledFrame code path. The component executes privileged behavior without verifying that the calling context holds the permission required to invoke it. This design gap allows a page rendered inside or interacting with a ControlledFrame to reach capabilities that should be restricted to authorized origins or embedders.

Attack Vector

Exploitation requires user interaction. An attacker hosts a crafted HTML page and lures a target to visit it through phishing, malvertising, or a compromised website. When the page loads in an unpatched Chrome build, it invokes the ControlledFrame code path that lacks the authorization check and bypasses the intended system access restriction. No verified public proof-of-concept is available at the time of publication. Refer to the Google Chrome Stable Update and Chromium Issue Tracker #511773417 for vendor technical detail.

Detection Methods for CVE-2026-87513

Indicators of Compromise

Chrome browser processes reporting a version string below 153.0.8010.36 after the patch release window.
Outbound HTTP(S) connections to newly registered or low-reputation domains immediately followed by unexpected local activity from chrome.exe.
Renderer or utility process spawning child processes or accessing local resources not typical for normal browsing sessions.

Detection Strategies

Inventory installed Chrome and Chromium-based browser versions across the fleet and flag any build below 153.0.8010.36.
Correlate web proxy logs with endpoint telemetry to identify users visiting untrusted pages that reference ControlledFrame or Isolated Web App manifests.
Alert on anomalous child process creation or file and registry access originating from Chrome renderer or utility processes.

Monitoring Recommendations

Monitor Chrome auto-update health and surface endpoints where updates are stalled or disabled by policy.
Track user reports of suspicious pages and correlate against browser version telemetry.
Review browser extension and Isolated Web App installations for unexpected additions during the exposure window.

How to Mitigate CVE-2026-87513

Immediate Actions Required

Update Google Chrome to 153.0.8010.36 or later on Windows, macOS, and Linux endpoints.
Restart Chrome after the update so the patched binaries are loaded into memory.
Verify that enterprise policies do not pin Chrome to an older major version that predates the fix.

Patch Information

Google released the fix in the Chrome Stable channel build 153.0.8010.36. Deployment details are documented in the Google Chrome Stable Update release notes, and the underlying defect is tracked in Chromium Issue Tracker #511773417. Chromium-derived browsers should apply their vendor's corresponding update once available.

Workarounds

Reinforce user awareness training to reduce the likelihood of interaction with crafted HTML pages delivered via phishing or malvertising.
Restrict or disable Isolated Web Apps and ControlledFrame usage through enterprise policy where the feature is not required.
Use web filtering to block access to known malicious and low-reputation domains until patch deployment is complete.

bash

# Verify installed Chrome version on Linux/macOS
google-chrome --version
# Expected output should be 153.0.8010.36 or later

# Windows: query the installed version from the registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version