CVE-2026-87521: Google Chrome Information Disclosure Flaw

CVE-2026-87521 Overview

CVE-2026-87521 is an information disclosure vulnerability in the WebMCP component of Google Chrome versions prior to 153.0.8010.36. A remote attacker who has already compromised the renderer process can obtain cross-origin data by serving a crafted HTML page to the victim. The flaw is tracked under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Chromium engineers rated the internal security severity as Medium, while NVD scoring places this at the lower end due to the required renderer compromise precondition and user interaction.

Critical Impact
Successful exploitation enables an attacker with a foothold in the renderer sandbox to read cross-origin data, breaking the browser's same-origin isolation guarantees.

Affected Products

Google Chrome (Desktop) prior to 153.0.8010.36
WebMCP component within the Chromium rendering pipeline
Downstream Chromium-based browsers that inherit the vulnerable WebMCP code path until they merge the upstream fix

Discovery Timeline

2026-09-09 - CVE-2026-87521 published to the National Vulnerability Database
2026-09-09 - Google publishes the Stable Channel update addressing the issue
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87521

Vulnerability Analysis

The vulnerability lives in WebMCP, a component within the Chrome renderer process. WebMCP fails to correctly enforce origin boundaries when handling specific operations initiated from a crafted HTML document. An attacker who has previously compromised the renderer can leverage this weakness to read data belonging to other web origins loaded in the browser.

Because the primary attack surface requires prior code execution inside the renderer, the vulnerability functions as a post-exploitation primitive. It is typically chained with a separate renderer compromise, such as a V8 type confusion or a use-after-free in Blink, to escalate impact from local script execution into cross-origin data theft.

The flaw does not, by itself, allow sandbox escape or code execution. Its value to an attacker is in defeating the same-origin policy that normally prevents one document from reading another's response bodies, tokens, or DOM contents.

Root Cause

The root cause is improper enforcement of cross-origin access controls in WebMCP handlers. When servicing requests originating from attacker-controlled HTML, the component returns or exposes state associated with origins other than the requesting document. This maps directly to CWE-200, exposure of sensitive information to an unauthorized actor.

Attack Vector

Exploitation requires the attacker to first compromise the Chrome renderer process, then serve a crafted HTML page to trigger the WebMCP information leak. User interaction is required, such as visiting a malicious site or opening attacker-controlled content. The network-reachable attack surface, combined with the requirement for a chained renderer exploit and user action, is reflected in the high attack complexity of this issue.

No public proof-of-concept, exploit code, or in-the-wild exploitation has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Refer to the Chromium Issue #512986143 for restricted technical details once Google opens the tracker entry.

Detection Methods for CVE-2026-87521

Indicators of Compromise

Chrome browser processes running versions prior to 153.0.8010.36 after the patch release date
Renderer process crashes or unexpected child-process spawns preceding cross-origin data exfiltration attempts
Outbound HTTPS beacons from browsing sessions that follow a visit to an untrusted page containing atypical WebMCP interactions

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build below 153.0.8010.36
Correlate browser telemetry with proxy or DNS logs to surface sessions where a user visited a low-reputation site followed by anomalous cross-origin requests
Monitor for renderer process instability, including tab crashes and repeated chrome.exe child restarts, which can indicate exploit attempts against Chromium components

Monitoring Recommendations

Ingest browser and endpoint telemetry into a centralized data lake and normalize with OCSF for cross-source correlation
Alert on execution of chrome.exe or chrome binaries whose reported version predates the fixed build
Track egress volume from browser processes to detect unusual data flows consistent with cross-origin content exfiltration

How to Mitigate CVE-2026-87521

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all Windows, macOS, and Linux endpoints
Restart Chrome after the update installs so the patched renderer binaries are loaded into memory
Audit Chromium-derived browsers such as Edge, Brave, Opera, and Vivaldi and apply their vendor updates once the WebMCP fix is merged downstream

Patch Information

Google released the fix in the Stable Channel update for desktop. Full details are available in the Google Chrome Stable Update announcement. Enterprise administrators should push the update through existing Chrome management infrastructure, such as Chrome Browser Cloud Management or standard software deployment tooling.

Workarounds

No supported workaround exists other than applying the vendor patch
Reduce exposure by enforcing strict site isolation policies and blocking navigation to low-reputation domains at the proxy or DNS layer
Restrict browser extensions and disable experimental Chrome features via enterprise policy until all endpoints are patched

bash

# Verify Chrome version on Linux/macOS endpoints
google-chrome --version

# Windows enterprise policy: force automatic updates via registry
reg add "HKLM\SOFTWARE\Policies\Google\Update" /v UpdateDefault /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Google\Update" /v AutoUpdateCheckPeriodMinutes /t REG_DWORD /d 60 /f