CVE-2026-87530: Google Chrome RCE Vulnerability

CVE-2026-87530 Overview

CVE-2026-87530 is an uncontrolled search path element vulnerability [CWE-427] in the CredentialProvider component of Google Chrome on Windows. Versions prior to 153.0.8010.36 allow a local attacker to execute arbitrary code outside the Chrome sandbox by planting a malicious binary that Chrome loads through an insecure search path. Chromium rates the underlying issue as Medium severity, while the NVD CVSS 3.1 score is 8.1 (HIGH) because a successful exploit escapes the sandbox and impacts confidentiality, integrity, and availability with scope change.

Critical Impact

A local attacker who can drop a file into a directory searched by Chrome's CredentialProvider can execute arbitrary code outside the browser sandbox, bypassing a core Chrome security boundary on Windows hosts.

Affected Products

• Google Chrome on Windows prior to 153.0.8010.36
• Microsoft Windows hosts running vulnerable Chrome builds
• Chromium-based deployments that reuse the affected CredentialProvider code path

Discovery Timeline

• 2026-09-09 - CVE-2026-87530 published to the National Vulnerability Database
• 2026-09-10 - Last updated in NVD database
• 2026-09 - Google releases the Stable channel update addressing the issue (Google Chrome Stable Update)

Technical Details for CVE-2026-87530

Vulnerability Analysis

The flaw resides in Chrome's CredentialProvider, a Windows integration surface used for credential-related workflows. Chrome loads a supporting module through a search path that is not fully constrained. When Windows resolves the module name, it searches directories that a local user can influence before reaching the intended trusted location.

Because the resulting code runs in the process context of CredentialProvider rather than the renderer sandbox, successful exploitation delivers execution outside Chrome's sandbox boundary. The CVSS scope change reflects this crossing of a security boundary from a low-privilege local attacker to a higher-privileged Chrome component. See Chromium Issue Tracker #518081914 for the upstream tracking record.

Root Cause

The root cause is an uncontrolled search path element [CWE-427]. Chrome invokes a dependency without specifying an absolute, validated path, so the Windows loader falls back to the standard DLL search order. That order can include directories writable by an unprivileged local user, allowing a planted binary to be loaded in place of the legitimate one.

Attack Vector

Exploitation requires local access. An attacker with the ability to write a crafted binary to a directory that appears earlier in the Windows search path than the legitimate module can trigger the vulnerable load when Chrome's CredentialProvider runs. Attack complexity is high because the attacker must control the search order and timing, but no user interaction and no privileges beyond local write access to a searched directory are required. The resulting code executes outside the Chrome sandbox on the Windows host.

No public proof-of-concept is available, and the issue is not listed on the CISA Known Exploited Vulnerabilities catalog. EPSS reports a low near-term exploitation probability at the time of publication.

Detection Methods for CVE-2026-87530

Indicators of Compromise

• Unsigned or unexpected DLLs appearing in directories that Windows resolves ahead of Chrome's installation directory for CredentialProvider-related modules.
• Chrome or Chromium processes loading modules from user-writable paths such as the current working directory, %TEMP%, or per-user application folders.
• Recently created executables or DLLs in directories adjacent to the Chrome binary with names matching legitimate Chrome dependencies.

Detection Strategies

• Enumerate loaded modules in Chrome processes and alert on any module signed by a publisher other than Google or Microsoft, particularly under CredentialProvider code paths.
• Correlate Sysmon Event ID 7 (Image Loaded) with the Chrome parent process to identify DLLs loaded from non-standard directories.
• Baseline the file inventory of the Chrome installation directory and flag additions or modifications outside Google's update mechanism.

Monitoring Recommendations

• Monitor endpoint telemetry for file writes to directories searched by Chrome, especially by non-installer processes.
• Track process creation chains where Chrome spawns unusual child processes shortly after browser launch or credential prompts.
• Ensure Windows event forwarding captures module load and file creation events on endpoints running Chrome. The Singularity Platform's Storyline technology can group these events into a single attack narrative for faster triage.

How to Mitigate CVE-2026-87530

Immediate Actions Required

• Update Google Chrome to version 153.0.8010.36 or later on all Windows endpoints.
• Restart Chrome after updating to ensure the patched binaries are loaded.
• Audit endpoints for writable directories that appear in the DLL search path used by Chrome and remove attacker-writable entries.
• Restrict local user write access to directories adjacent to the Chrome installation path.

Patch Information

Google addressed the vulnerability in the Stable channel update for desktop referenced in the Google Chrome Stable Update. Enterprise deployments should validate through their configured update channel that Chrome is at 153.0.8010.36 or newer. Confirm the version by opening chrome://settings/help or by querying the installed application inventory through endpoint management tooling.

Workarounds

• If patching must be delayed, remove or lock down write permissions on directories that Windows may search before the Chrome installation directory.
• Enforce Windows AppLocker or Windows Defender Application Control policies to block unsigned DLLs from loading into Chrome processes.
• Limit local user privileges on shared or kiosk systems where multiple users can influence file system state.

# Verify installed Chrome version on Windows (PowerShell)
Get-ItemProperty "HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome" |
  Select-Object DisplayName, DisplayVersion

# Ensure the reported DisplayVersion is 153.0.8010.36 or later