CVE-2026-87519: Google Chrome Auth Bypass Vulnerability

CVE-2026-87519 Overview

CVE-2026-87519 is an incorrect authorization vulnerability in the Safe Browsing component of Google Chrome. The flaw affects Chrome versions prior to 153.0.8010.36 and is tracked under CWE-863: Incorrect Authorization. A remote attacker can bypass system access restrictions by delivering a crafted HTML page and leveraging social engineering to induce user interaction. Google classified the Chromium security severity as Low. The issue affects Chrome across desktop platforms served by the Stable channel update referenced in the vendor advisory.

Critical Impact
An attacker who convinces a user to interact with a malicious page can bypass Safe Browsing access checks, undermining a security control designed to warn users about dangerous downloads and sites.

Affected Products

Google Chrome Desktop versions prior to 153.0.8010.36
Chromium-based browsers incorporating the vulnerable Safe Browsing component
Chrome Stable channel installations pending the vendor update

Discovery Timeline

2026-09-09 - CVE-2026-87519 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87519

Vulnerability Analysis

The vulnerability resides in Chrome's Safe Browsing subsystem, which is responsible for evaluating web content against Google's malicious content lists and enforcing warnings or blocks. Incorrect authorization logic allows a crafted HTML page to bypass system access restrictions that Safe Browsing normally enforces. Successful exploitation requires social engineering, meaning the target must be convinced to visit an attacker-controlled page or perform a specific interaction. The result is degradation of a client-side security boundary rather than direct code execution. See the Chromium Issue Tracker entry for tracking details.

Root Cause

The root cause is an authorization check within the Safe Browsing component that does not correctly validate the caller or context before permitting a restricted action. CWE-863 describes conditions in which an actor is permitted to perform an operation without proper verification that the actor holds the required privileges. In this case, the flawed check enables bypass of protections that would otherwise block or warn on access to certain resources.

Attack Vector

Exploitation requires a remote attacker to host a crafted HTML page and use social engineering to bring the victim to that page. The Exploit Prediction Scoring System (EPSS) probability at publication is 0.247%, placing it in the 15.9 percentile. No public exploit code or proof of concept has been observed, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Because exploitation is entirely client-side and depends on user interaction, mass automated exploitation is unlikely, but targeted phishing scenarios remain plausible.

No verified proof-of-concept code has been released. Refer to the Chromium Issue Tracker #501763003 once access restrictions are lifted for technical specifics.

Detection Methods for CVE-2026-87519

Indicators of Compromise

Chrome browser processes running versions prior to 153.0.8010.36 on managed endpoints
Browser navigation events to newly registered or low-reputation domains hosting HTML content that triggers Safe Browsing interactions
User reports of unexpected downloads or missing Safe Browsing warnings after visiting external links

Detection Strategies

Inventory browser versions across the fleet and flag any Chrome installation below 153.0.8010.36
Correlate email and messaging telemetry with browser navigation logs to identify social engineering pathways leading to crafted HTML content
Monitor for anomalies in Safe Browsing warning frequency, which may indicate suppressed or bypassed enforcement

Monitoring Recommendations

Ingest browser and endpoint telemetry into a centralized analytics platform to track Chrome version compliance over time
Alert on execution of downloaded content that follows navigation to recently registered domains
Review web proxy and DNS logs for outbound requests to phishing infrastructure targeting browser users

How to Mitigate CVE-2026-87519

Immediate Actions Required

Update Chrome to version 153.0.8010.36 or later on all desktop endpoints
Verify automatic update policies are enabled and functioning across managed devices
Communicate phishing awareness reminders to users, emphasizing caution with links from unknown senders

Patch Information

Google addressed the vulnerability in the Chrome Stable channel release documented in the Stable Channel Update for Desktop. Administrators should confirm deployment of version 153.0.8010.36 or later. Chromium-based browsers that consume upstream Safe Browsing changes should be updated once their vendors publish corresponding builds.

Workarounds

Restrict browsing to trusted domains through enterprise web filtering where feasible
Deploy group policy or MDM configurations that enforce automatic Chrome updates and block downgrade
Increase user awareness training focused on identifying crafted pages and unsolicited download prompts

bash

# Verify installed Chrome version on Windows endpoints
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# Verify installed Chrome version on macOS endpoints
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString

# Verify installed Chrome version on Linux endpoints
google-chrome --version