CVE-2026-87516: Google Chrome Information Disclosure Flaw

CVE-2026-87516 Overview

CVE-2026-87516 is an observable discrepancy vulnerability in the Navigation component of Google Chrome prior to version 153.0.8010.36. A remote attacker can leak cross-origin data by tricking a user into visiting a crafted HTML page. The flaw is classified under CWE-203: Observable Discrepancy, a side-channel weakness that allows attackers to infer protected information based on behavioral differences.

Chromium's security team rated the underlying issue as Medium severity. Exploitation requires user interaction, typically loading an attacker-controlled web page in a vulnerable Chrome browser.

Critical Impact
Remote attackers can leak cross-origin data across security boundaries through crafted HTML pages, undermining the same-origin policy that isolates web content.

Affected Products

Google Chrome versions prior to 153.0.8010.36 (Desktop, Stable channel)
Chromium-based browsers incorporating vulnerable Navigation component code
Any platform running affected Chrome builds (Windows, macOS, Linux)

Discovery Timeline

2026-09-09 - CVE-2026-87516 published to NVD
2026-09-09 - Last updated in NVD database
2026-09 - Google releases Chrome Stable Channel update addressing the issue (Chrome Stable Channel Update)

Technical Details for CVE-2026-87516

Vulnerability Analysis

The vulnerability resides in Chrome's Navigation subsystem, which governs how the browser transitions between documents and enforces cross-origin boundaries. An observable discrepancy occurs when the browser exposes behavior, such as timing, response codes, or state changes, that differs based on cross-origin resource properties. Attackers use these differences to infer information that should remain isolated by the same-origin policy.

The attack requires user interaction. A victim must visit an attacker-controlled page that issues navigations or requests designed to probe the discrepancy. Successful exploitation results in limited confidentiality impact without affecting integrity or availability.

Root Cause

The root cause is a side-channel weakness [CWE-203] in the Navigation code path. Behavioral differences between navigations to accessible versus restricted origins allow observation of cross-origin state. Google has not publicly disclosed granular implementation details in the Chromium Issue Tracker entry (Chromium Issue Tracker Entry) at the time of publication.

Attack Vector

An attacker hosts a malicious HTML page and lures a victim into visiting it. The page uses scripted navigations or embedded resources targeting a cross-origin endpoint. By measuring the observable discrepancy in Chrome's Navigation handling, the attacker deduces cross-origin data such as authentication state, resource existence, or user-specific attributes.

No public proof-of-concept exploit is available. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability remains low, reflecting no observed in-the-wild exploitation activity.

Detection Methods for CVE-2026-87516

Indicators of Compromise

Chrome browser versions below 153.0.8010.36 present in endpoint inventory
Outbound connections from browser processes to newly registered or low-reputation domains hosting crafted HTML
Anomalous cross-origin navigation patterns in browser telemetry, such as rapid iframe or window.open sequences targeting authenticated third-party sites

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build older than 153.0.8010.36
Correlate browser process telemetry with web proxy logs to identify pages issuing high volumes of cross-origin navigation probes
Monitor for known malicious URLs referenced in threat intelligence feeds targeting Chromium side-channel flaws

Monitoring Recommendations

Ingest browser and endpoint telemetry into a centralized SIEM for version tracking and behavioral analysis
Alert on Chrome instances that fail to auto-update within a defined patch window
Track user reports of unexpected navigation behavior or session leakage on sensitive web applications

How to Mitigate CVE-2026-87516

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all Desktop platforms
Verify enterprise auto-update policies deliver the Stable channel patch to managed fleets
Restart browsers after update installation to ensure the patched Navigation component is loaded

Patch Information

Google addressed CVE-2026-87516 in the Chrome Stable channel update to 153.0.8010.36. Administrators should review the Chrome Stable Channel Update advisory and validate deployment through Group Policy, Chrome Browser Cloud Management, or equivalent configuration channels. Chromium-derivative browsers require vendor-supplied updates incorporating the upstream fix.

Workarounds

Restrict browsing to trusted sites through enterprise web filtering until patched builds are deployed
Enforce Chrome enterprise policies that disable third-party cookies and cross-site tracking to reduce exposure to cross-origin inference
Educate users to avoid clicking links from untrusted sources during the patch window

bash

# Verify installed Chrome version on Windows
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Verify installed Chrome version on macOS
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString

# Verify installed Chrome version on Linux
google-chrome --version