CVE-2026-87537: Google Chrome Extensions RCE Vulnerability

CVE-2026-87537 Overview

CVE-2026-87537 is a missing authorization vulnerability in the Extensions component of Google Chrome prior to version 153.0.8010.36. A remote attacker who has already compromised the renderer process can potentially execute arbitrary code outside the Chrome sandbox by delivering crafted network traffic. The weakness is tracked under CWE-862 (Missing Authorization) and is classified as HIGH severity. Chromium's internal security team rated the underlying issue as Medium, but the network-reachable sandbox escape path elevates the practical risk to enterprise browser fleets.

Critical Impact

Successful exploitation chains this flaw with a prior renderer compromise to escape the Chrome sandbox and execute arbitrary code on the host.

Affected Products

• Google Chrome (Stable channel) versions prior to 153.0.8010.36
• Chromium-based browsers that inherit the vulnerable Extensions authorization logic
• Desktop platforms distributed through the Chrome Stable release channel

Discovery Timeline

• 2026-09-09 - CVE-2026-87537 published to NVD
• 2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87537

Vulnerability Analysis

The vulnerability resides in the Extensions subsystem of Google Chrome. Chrome's multi-process architecture isolates web content in sandboxed renderer processes, while privileged operations run in the browser process. Extensions bridge these boundaries through defined APIs that must enforce authorization checks on every request that crosses the sandbox.

CVE-2026-87537 exists because an authorization check is missing on an Extensions code path reachable from a compromised renderer. An attacker who already controls a renderer can send crafted network-shaped messages to the Extensions layer and invoke privileged behavior without proper authorization. The result is code execution outside the sandbox, effectively negating a core Chrome security boundary.

Root Cause

The root cause is a missing authorization check (CWE-862) in Extensions request handling. Trust decisions rely on the caller's context rather than an explicit permission verification, allowing a compromised renderer to reach functionality that should be gated to higher-privileged callers.

Attack Vector

Exploitation requires network reachability and a pre-existing renderer compromise, which the CVSS vector reflects with high attack complexity. After compromising the renderer through a separate flaw such as a memory corruption bug in the JavaScript engine, the attacker issues crafted network traffic that is processed by the Extensions component. The missing authorization check allows the request to reach sensitive functionality and pivot into arbitrary code execution outside the sandbox.

No public proof-of-concept, exploit-database entry, or CISA KEV listing is associated with this CVE at time of publication. See the Chromium Issue Tracker #498732709 and the Google Chrome Stable Update announcement for vendor context.

Detection Methods for CVE-2026-87537

Indicators of Compromise

• Chrome browser processes spawning unexpected child processes such as cmd.exe, powershell.exe, or shell interpreters on macOS and Linux hosts
• Unsigned or unexpected modules loaded into chrome.exe or the Google Chrome Helper process
• Chrome-originating outbound connections to newly observed domains immediately preceded by extension activity
• Presence of Chrome installations running versions earlier than 153.0.8010.36

Detection Strategies

• Inventory Chrome versions across managed endpoints and flag any build below 153.0.8010.36
• Alert on process lineage where chrome.exe or its helpers spawn scripting or LOLBin processes
• Correlate renderer crashes with subsequent privileged process activity to surface sandbox-escape attempts

Monitoring Recommendations

• Ingest browser telemetry and endpoint process events into a centralized data lake for cross-host correlation
• Monitor Chrome extension install, update, and message-passing events for anomalous frequency or origin
• Track outbound network connections initiated by browser child processes and validate against known good baselines

How to Mitigate CVE-2026-87537

Immediate Actions Required

• Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints
• Force-restart Chrome after deployment to ensure the patched binary is loaded across all user sessions
• Audit installed extensions and remove those that are unused, unmaintained, or from untrusted publishers
• Prioritize patching on high-value endpoints and systems exposed to untrusted web content

Patch Information

Google addressed CVE-2026-87537 in the Chrome Stable channel release 153.0.8010.36. Refer to the Google Chrome Stable Update announcement for release details and the Chromium Issue Tracker #498732709 for issue metadata. Enterprises using Chrome Browser Cloud Management or MSI-based deployments should push the updated build through their standard channel.

Workarounds

• Enforce Chrome auto-update policies through group policy or MDM to minimize exposure windows
• Restrict extension installation to an allowlist using the ExtensionInstallAllowlist enterprise policy
• Apply the ExtensionInstallBlocklist policy set to * where extensions are not required for business operations
• Segment browsing of untrusted content to isolated or ephemeral virtual environments until patching completes

# Configuration example: Chrome enterprise policy to restrict extensions (Windows registry)
reg add "HKLM\Software\Policies\Google\Chrome\ExtensionInstallBlocklist" /v 1 /t REG_SZ /d "*" /f
reg add "HKLM\Software\Policies\Google\Chrome\ExtensionInstallAllowlist" /v 1 /t REG_SZ /d "<approved-extension-id>" /f

# Verify installed Chrome version on Windows
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.FileVersion