CVE-2026-87532: Google Chrome Safebrowsing Auth Bypass

CVE-2026-87532 Overview

CVE-2026-87532 is an improper state validation flaw in the Safe Browsing component of Google Chrome prior to version 153.0.8010.36. A remote attacker can bypass system access restrictions by convincing a user to visit a crafted HTML page. The Chromium project classifies the security severity as Medium. The weakness maps to [CWE-754: Improper Check for Unusual or Exceptional Conditions], where Safe Browsing fails to correctly evaluate its own protective state before permitting a sensitive action.

Critical Impact
A crafted web page can bypass Safe Browsing checks and defeat system access restrictions that normally block untrusted content and downloads.

Affected Products

Google Chrome for Desktop prior to 153.0.8010.36
Chromium-based browsers embedding vulnerable Safe Browsing logic
Downstream distributions synchronizing with the Chrome Stable channel

Discovery Timeline

2026-09-09 - CVE-2026-87532 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87532

Vulnerability Analysis

The vulnerability resides in Chrome's Safe Browsing subsystem, which enforces reputation checks and access restrictions on navigations and downloads. Safe Browsing fails to validate an internal state transition before authorizing an action. An attacker exploits this by serving a specifically constructed HTML page that steers the component into an inconsistent state. Once the state check is skipped or misinterpreted, restrictions that would normally block the operation no longer apply.

Exploitation requires user interaction, consistent with a standard web-browsing scenario, and does not require prior authentication. Confidentiality is not directly affected, but the flaw enables integrity impact by allowing content or actions that policy should have denied.

Root Cause

The root cause is improper state validation, aligned with [CWE-754]. Safe Browsing enters a code path that assumes a specific precondition without confirming the current state satisfies it. A crafted page manipulates the sequence of events so that the guard is bypassed, allowing a downstream operation to proceed under weakened restrictions.

Attack Vector

The attack vector is network-based via the browser. A remote attacker hosts a malicious page and induces a victim to load it through phishing, malvertising, or a compromised site. The page triggers the state confusion in Safe Browsing, after which system access restrictions enforced by the browser are bypassed. No elevated privileges are required on the target host, and no additional client software is needed beyond a vulnerable Chrome build.

No public proof-of-concept code is available. Refer to the Chromium Issue Tracker #517369256 and the Google Chrome Stable Update advisory for vendor-supplied technical context.

Detection Methods for CVE-2026-87532

Indicators of Compromise

Chrome browser processes running versions earlier than 153.0.8010.36 on managed endpoints.
Outbound navigations to newly registered or low-reputation domains immediately followed by file writes to user download directories.
Safe Browsing telemetry gaps or unexpected suppression of interstitial warnings for known-bad URLs.

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any build below 153.0.8010.36.
Correlate browser child-process launches with downloads that did not trigger a Safe Browsing prompt.
Alert on execution of files freshly written by a Chrome renderer or utility process, particularly scripts and installers.

Monitoring Recommendations

Ingest browser and endpoint telemetry into a centralized data lake to correlate navigation, download, and execution events.
Monitor Google's Chrome Releases blog for follow-up advisories referencing the same component.
Track user-reported bypasses of download warnings and unexpected file executions originating from browsing sessions.

How to Mitigate CVE-2026-87532

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all Windows, macOS, and Linux endpoints.
Restart Chrome after the update to ensure the patched Safe Browsing component is loaded.
Audit Chromium-derived browsers and embedded WebView components for vendor patches aligned to the same fix.

Patch Information

Google addressed the flaw in the Chrome Stable channel at version 153.0.8010.36. Details are published in the Google Chrome Stable Update release notes, with the underlying report tracked at Chromium Issue Tracker #517369256. Enterprises using managed updates should verify their update policy permits Chrome to reach the fixed build without delay.

Workarounds

Enforce automatic browser updates through group policy or mobile device management to eliminate lag on patch adoption.
Restrict downloads and script execution from untrusted domains via web proxy or DNS filtering while patches propagate.
Educate users to avoid interacting with unsolicited links, since exploitation requires opening a crafted page.

bash

# Verify installed Chrome version on Linux and macOS endpoints
google-chrome --version
# Expected output: Google Chrome 153.0.8010.36 or later

# Windows: query the installed version from the registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version