CVE-2026-87539 Overview
CVE-2026-87539 is an observable discrepancy vulnerability [CWE-203] in the Network component of Google Chrome. The flaw exists in Chrome versions prior to 153.0.8010.36. A remote attacker can leverage the discrepancy to obtain cross-origin data through a crafted HTML page. Successful exploitation requires user interaction, such as visiting an attacker-controlled site. Chromium classifies the security severity as Medium, while the NVD assigns a low CVSS rating due to the limited confidentiality impact and high attack complexity. The issue affects the desktop Stable channel and was addressed in the September 2026 Chrome Stable update.
Critical Impact
A remote attacker can bypass the Same-Origin Policy and infer or read cross-origin data from a victim's browser session through a crafted web page.
Affected Products
- Google Chrome for Desktop prior to 153.0.8010.36
- Chromium-based browsers incorporating the vulnerable Network component
- Downstream distributions that ship pre-patch Chromium builds
Discovery Timeline
- 2026-09-09 - CVE-2026-87539 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-87539
Vulnerability Analysis
The vulnerability is an observable discrepancy [CWE-203] in Chrome's Network stack. Observable discrepancy flaws occur when a system's behavior, response timing, or error signaling differs measurably based on protected information. An attacker who can observe those signals can infer data that should remain isolated by the Same-Origin Policy.
In this case, the discrepancy exists in how the Network component handles cross-origin requests. A crafted HTML page can trigger network operations whose observable side effects reveal information about resources on other origins. This defeats one of the browser's core isolation boundaries.
The attack requires user interaction, meaning the victim must load the malicious page. The confidentiality impact is limited to information leakage; the flaw does not permit code execution or data modification.
Root Cause
The root cause is an information exposure through discrepancy in Chrome's Network component. Response characteristics for cross-origin requests differ in ways that an attacker-controlled page can measure and correlate with underlying data. Full technical detail is restricted in the Chromium Issue Tracker #513003268 pending broader patch rollout.
Attack Vector
Exploitation is remote over the network and requires the victim to visit a crafted HTML page. The attacker hosts JavaScript and markup that issue cross-origin network requests and observe timing, status, or resource-loading side effects. From these observations, the attacker infers cross-origin data such as authenticated resource state on third-party sites. No privileges are required on the target system, but the elevated attack complexity reflects the precision needed to reliably extract data. Refer to the Chrome Stable Channel Update for release-level details.
No public proof-of-concept code is available. The vulnerability mechanism is described in prose only; readers should consult the vendor references above for authoritative technical details.
Detection Methods for CVE-2026-87539
Indicators of Compromise
- Browser telemetry showing Chrome desktop clients running versions below 153.0.8010.36 after the September 2026 patch window.
- Web proxy logs containing repeated cross-origin fetch or resource-load patterns from a single origin toward multiple third-party endpoints.
- User reports of unexpected page behavior after visiting untrusted links, particularly in phishing or malvertising campaigns.
Detection Strategies
- Inventory installed Chrome versions across managed endpoints and flag any build earlier than 153.0.8010.36.
- Inspect outbound web traffic for suspicious pages that generate high-volume cross-origin requests characteristic of side-channel probing.
- Correlate browser version data with visited-URL telemetry to prioritize unpatched hosts that browse arbitrary web content.
Monitoring Recommendations
- Enable centralized Chrome update reporting through enterprise management to track patch adoption.
- Monitor DNS and HTTP proxy logs for domains newly associated with cross-origin data exfiltration techniques.
- Track user interaction alerts from web filtering tools when users navigate to low-reputation domains hosting active scripts.
How to Mitigate CVE-2026-87539
Immediate Actions Required
- Update Google Chrome on all desktop platforms to 153.0.8010.36 or later.
- Force-restart Chrome after deploying the update so the new binary is loaded into active browser sessions.
- Audit Chromium-based browsers in the environment and apply vendor updates once they incorporate the upstream fix.
Patch Information
Google released the fix in the Chrome Stable Channel update covering desktop platforms. Administrators should deploy Chrome 153.0.8010.36 or newer. See the Chrome Stable Channel Update for full release notes and the Chromium Issue Tracker #513003268 for the underlying issue reference.
Workarounds
- Restrict browsing to trusted sites through enterprise web filtering until patches are fully deployed.
- Disable or restrict JavaScript on high-risk endpoints where updates cannot be applied immediately.
- Use browser policies to enforce Site Isolation and block third-party cookies to reduce cross-origin inference surface.
# Verify Chrome version on Linux/macOS endpoints
google-chrome --version
# Windows managed deployment: enforce minimum version via Group Policy
# Set: Computer Configuration > Administrative Templates > Google > Google Chrome
# Policy: TargetVersionPrefix = 153.0.8010.36
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
