CVE-2026-87543: Google Chrome Authorization Bypass Vulnerability

CVE-2026-87543 Overview

CVE-2026-87543 is a missing authorization vulnerability in the Core component of Google Chrome prior to version 153.0.8010.36. The flaw allows a remote attacker who has already compromised the renderer process to bypass site isolation via a crafted HTML page. Site isolation is a core browser security boundary that separates web content from different origins into distinct processes. Bypassing this boundary weakens Chrome's defense-in-depth model against cross-origin attacks originating from a compromised renderer. Chromium classifies the security severity as Low, and the issue is tracked under CWE-862: Missing Authorization.

Critical Impact
A remote attacker with a compromised renderer process can bypass Chrome's site isolation boundary, undermining cross-origin protections and exposing users to expanded attack surface within the browser.

Affected Products

Google Chrome versions prior to 153.0.8010.36
Chromium-based browsers sharing the affected Core component
Desktop Stable channel builds released before the September 2026 update

Discovery Timeline

2026-09-09 - CVE-2026-87543 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87543

Vulnerability Analysis

The vulnerability resides in Chrome's Core component and stems from a missing authorization check that should enforce site isolation guarantees. Site isolation separates documents from different sites into distinct renderer processes to prevent cross-origin data access. When authorization is not verified for a specific inter-process operation, a renderer that an attacker already controls can request or influence resources belonging to another site.

Exploitation requires the attacker to first compromise the renderer process. This is typically achieved by chaining a separate memory corruption or logic flaw. The missing authorization then serves as a second-stage primitive, letting the attacker escape the intended origin boundary without needing a full sandbox escape.

User interaction is required, as the victim must load a crafted HTML page. The confidentiality and availability impacts are none, while integrity is limited. The narrow scope reflects the prerequisite of a prior renderer compromise. Details are referenced in Chromium Issue Tracker #502452118.

Root Cause

The root cause is a CWE-862: Missing Authorization weakness in a Core code path that should validate the requesting frame or process against site isolation policy. Without this check, the browser accepts operations that violate the per-site process model.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker hosts a crafted HTML page and lures the victim to visit it. After compromising the renderer process through a separate primitive, the attacker leverages the missing authorization check to bypass site isolation and act against other sites loaded by the browser.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-87543

Indicators of Compromise

Chrome browser processes running versions earlier than 153.0.8010.36 after the vendor patch release date
Unexpected renderer process crashes or restarts correlated with visits to untrusted sites
Browser telemetry showing cross-origin resource access patterns that violate site isolation expectations

Detection Strategies

Inventory endpoint Chrome installations and flag versions below 153.0.8010.36 for remediation prioritization
Correlate browser process telemetry with network connections to newly registered or low-reputation domains hosting HTML payloads
Monitor for renderer exploitation precursors such as anomalous JIT activity, unusual child process creation, or crash dumps in Chrome subprocesses

Monitoring Recommendations

Enable endpoint detection and response telemetry for Chrome child processes, focusing on renderer crashes and abnormal IPC patterns
Ingest browser version data into a centralized data lake to track patch adoption across the estate
Alert on outbound traffic from browser processes to domains associated with exploit delivery kits

How to Mitigate CVE-2026-87543

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints
Force-restart Chrome after deployment to ensure patched binaries are loaded
Verify enterprise policy configuration requires automatic updates for the Stable channel

Patch Information

Google addressed CVE-2026-87543 in the Chrome Stable channel update announced in the Google Chrome Stable Update. Administrators should deploy version 153.0.8010.36 or newer through their standard update infrastructure. Chromium-based browser vendors typically ship equivalent fixes shortly after the upstream release.

Workarounds

No official workaround has been published; patching is the recommended remediation
Restrict browsing to trusted sites and enforce web filtering policies until patches are deployed
Consider deploying browser isolation or remote browser technologies for high-risk user groups

bash

# Verify installed Chrome version on Windows via PowerShell
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Verify installed Chrome version on Linux
google-chrome --version