CVE-2026-87531: Google Chrome CORS Information Disclosure

CVE-2026-87531 Overview

CVE-2026-87531 is an information disclosure vulnerability in the Cross-Origin Resource Sharing (CORS) implementation of Google Chrome versions prior to 153.0.8010.36. A remote attacker who has already compromised the renderer process can obtain cross-origin data by delivering a crafted HTML page to the victim. The Chromium project rated this issue as Medium severity, while the NVD assigned a low CVSS score reflecting high attack complexity and the requirement for prior renderer compromise. The flaw is tracked under [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor].

Critical Impact
Attackers with a compromised renderer process can bypass the Same-Origin Policy through the CORS layer and exfiltrate cross-origin data from other web contexts loaded in the browser.

Affected Products

Google Chrome for Desktop versions prior to 153.0.8010.36
Chromium-based browsers sharing the affected CORS implementation
All operating system builds (Windows, macOS, Linux) of the Stable channel prior to the fix

Discovery Timeline

2026-09-09 - CVE-2026-87531 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database
2026-09 - Google publishes the Stable channel update for Desktop addressing this issue (Google Chrome Stable Update)

Technical Details for CVE-2026-87531

Vulnerability Analysis

The vulnerability resides in Chrome's CORS enforcement path. CORS is a browser-level mechanism that mediates which cross-origin responses a document may read. When the browser mishandles a specific CORS decision, cross-origin response data can leak into an origin that should not observe it.

Exploitation requires the attacker to have already compromised the renderer process, typically through a separate memory corruption or logic bug. With renderer control, the attacker crafts an HTML page that triggers the flawed CORS code path and receives cross-origin bytes back into attacker-controlled JavaScript state. User interaction is required, consistent with the delivery of a crafted page.

Successful exploitation results in confidentiality loss without direct integrity or availability impact. The primary risk is disclosure of authenticated cross-origin content such as session data, personal information rendered in other tabs, or API responses fetched by cooperating sites.

Root Cause

The root cause is improper enforcement of cross-origin access controls in the CORS component, classified as [CWE-200]. The browser's checks fail to fully isolate response data when the renderer supplies specifically shaped requests, allowing cross-origin data intended to remain opaque to become readable. Full technical details are tracked in the Chromium Issue Tracker Entry.

Attack Vector

The attack is network-based and requires user interaction. A victim must load attacker-controlled content in a renderer that the attacker has already compromised. The attacker then issues cross-origin fetches or subresource requests whose responses are exposed through the CORS flaw. No privileges on the target origin are required beyond the ability to trigger loads from the compromised renderer. See the Chromium Issue Tracker Entry for technical specifics.

Detection Methods for CVE-2026-87531

Indicators of Compromise

Chrome processes running versions earlier than 153.0.8010.36 after the patch release window
Renderer processes making anomalous bursts of fetch() or XMLHttpRequest calls to unrelated third-party origins
Web content requesting cross-origin resources with unusual Origin headers not aligned to the top-level document
Endpoint telemetry showing renderer child processes spawning unexpected subprocesses or writing unexpected files, indicating prior renderer compromise

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build below 153.0.8010.36
Monitor proxy or DNS logs for cross-origin request patterns inconsistent with the visited site's normal behavior
Correlate browser exploitation indicators (renderer crashes, sandbox anomalies) with subsequent cross-origin traffic, since this bug requires a pre-existing renderer compromise
Alert on Chrome installations that fail to update within the organization's patch service-level window

Monitoring Recommendations

Enable browser management telemetry through Chrome Enterprise reporting to track version compliance and extension activity
Forward endpoint and proxy logs into a centralized analytics platform for cross-origin traffic baselining
Track Chromium security release notes and correlate with vulnerability management ticket closure
Review Content Security Policy (CSP) violation reports from internal web applications for unexpected cross-origin fetches

How to Mitigate CVE-2026-87531

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints
Restart Chrome after the update so the patched binaries are loaded into active browser sessions
Audit deployed Chromium-based browsers (Edge, Brave, Opera, Vivaldi) and apply their corresponding upstream-patched releases
Prioritize patching for high-value users who authenticate to sensitive web applications from Chrome

Patch Information

Google released the fix in the Stable channel update for Desktop that ships Chrome 153.0.8010.36. Refer to the Google Chrome Stable Update advisory for the full list of addressed issues. Enterprises using Chrome Browser Cloud Management or Group Policy should verify that auto-update is enabled and that the update rollout has reached all endpoints.

Workarounds

No vendor-supplied workaround exists; upgrading Chrome is the supported remediation path
Reduce attack surface by restricting installation of untrusted browser extensions that could aid a renderer compromise chain
Enforce strict site isolation and disable legacy web platform features not required by business applications
Use enterprise policies to block navigation to uncategorized or high-risk sites where a compromised renderer could be triggered

bash

# Example: enforce Chrome auto-update and minimum version via policy on Linux
# /etc/opt/chrome/policies/managed/chrome-cve-2026-87531.json
{
  "DefaultBrowserSettingEnabled": true,
  "ComponentUpdatesEnabled": true,
  "RelaunchNotification": 2,
  "RelaunchNotificationPeriod": 86400000,
  "TargetVersionPrefix": "153.0.8010."
}