CVE-2026-87523: Google Chrome Race Condition Vulnerability

CVE-2026-87523 Overview

CVE-2026-87523 is a race condition vulnerability in the DataTransfer component of Google Chrome. The flaw affects Chrome versions prior to 153.0.8010.36 and is classified under CWE-367: Time-of-check Time-of-use (TOCTOU). A remote attacker can exploit the condition through a crafted HTML page combined with social engineering to obtain sensitive information from the browser. The Chromium project rated the underlying security severity as Low, while the National Vulnerability Database (NVD) assigned a medium severity rating. Exploitation requires user interaction and depends on winning a narrow timing window.

Critical Impact
Successful exploitation allows a remote attacker to disclose sensitive in-browser data through crafted content and user interaction with the DataTransfer interface.

Affected Products

Google Chrome versions prior to 153.0.8010.36
Chromium-based browsers incorporating the vulnerable DataTransfer implementation
Desktop Chrome Stable channel builds released before the September 2026 update

Discovery Timeline

2026-09-09 - CVE-2026-87523 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87523

Vulnerability Analysis

The vulnerability resides in Chrome's DataTransfer interface, which handles clipboard and drag-and-drop data exchange between web content and the browser. A race condition occurs when concurrent operations access or modify DataTransfer state without proper synchronization. An attacker can manipulate this timing gap to read data that should remain isolated from the origin serving the malicious page. The condition is classified as CWE-367, a time-of-check to time-of-use flaw where security decisions become invalid before the resource is actually used. Exploitation requires user interaction, such as performing a drag-and-drop or paste operation that the attacker's page can influence.

Root Cause

The root cause is insufficient synchronization around DataTransfer state transitions. Between the moment Chrome validates a data access and the moment the data is delivered to script, another concurrent operation can alter the underlying state. This TOCTOU condition breaks the origin isolation assumptions the interface relies on.

Attack Vector

Exploitation proceeds over the network through a crafted HTML page. The attacker lures a victim to the page and induces an interaction, such as a drag, drop, or paste gesture, that triggers DataTransfer handling. High attack complexity reflects the difficulty of reliably winning the race window. Successful exploitation returns sensitive data to attacker-controlled script.

No verified proof-of-concept code is publicly available. See the Chromium Issue Tracker Entry for restricted technical details.

Detection Methods for CVE-2026-87523

Indicators of Compromise

Chrome browser processes running versions earlier than 153.0.8010.36 in enterprise inventory data
Unexpected navigation to unfamiliar HTML pages that solicit drag-and-drop or paste interactions
Outbound HTTP or WebSocket traffic to unknown domains immediately following clipboard or drag interactions

Detection Strategies

Query endpoint telemetry for installed Chrome versions and flag any host running a build below 153.0.8010.36.
Correlate browser child-process activity with user-interaction events to surface pages that repeatedly attempt clipboard or drag-and-drop APIs.
Monitor web proxy logs for pages that embed unusual DataTransfer scripting patterns combined with social engineering prompts.

Monitoring Recommendations

Track Chrome auto-update compliance across managed endpoints and alert on stalled updates.
Ingest browser and endpoint telemetry into a centralized data lake to correlate suspicious page visits with data-exfiltration attempts.
Review phishing and social engineering reports for lures that instruct users to drag, drop, or paste content into web pages.

How to Mitigate CVE-2026-87523

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints.
Verify update deployment through centralized browser management tools and endpoint inventory reports.
Reinforce user awareness training on drag-and-drop and paste-based social engineering on untrusted sites.

Patch Information

Google addressed CVE-2026-87523 in the Chrome Stable channel update documented in the Google Chrome Stable Update advisory. Administrators should ensure all Chrome installations are on 153.0.8010.36 or later. Chromium-based browsers should apply vendor-supplied updates that incorporate the upstream fix.

Workarounds

Enable Chrome's automatic update mechanism and restart browser sessions to apply pending updates.
Restrict access to untrusted websites through enterprise web filtering until patching completes.
Use browser policies to limit clipboard and drag-and-drop permissions on unmanaged or high-risk sites where feasible.

bash

# Configuration example: verify installed Chrome version on Linux endpoints
google-chrome --version
# Expected output: Google Chrome 153.0.8010.36 or later