CVE-2026-87544: Google Chrome Extensions Authorization Bypass

CVE-2026-87544 Overview

CVE-2026-87544 is an incorrect authorization vulnerability in the Extensions component of Google Chrome. Versions prior to 153.0.8010.36 fail to enforce system access restrictions when handling extension interactions with privileged pages. A remote attacker can exploit the flaw by serving a crafted HTML page to a target browser. Successful exploitation bypasses access controls and grants entry into a privileged page context. The weakness is tracked under CWE-863: Incorrect Authorization. Google's Chromium team rated the internal security severity as Low, though the assigned CVSS score reflects broader potential impact on confidentiality, integrity, and availability.

Critical Impact
A crafted web page can bypass Chrome's extension authorization checks and reach a privileged browser page, exposing users to further compromise without any authentication or interaction beyond visiting the page.

Affected Products

Google Chrome Desktop versions prior to 153.0.8010.36
All operating system builds of Chrome Stable channel below the patched release
Chromium-derived browsers that have not integrated the upstream fix

Discovery Timeline

2026-09-09 - CVE CVE-2026-87544 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87544

Vulnerability Analysis

The vulnerability resides in Chrome's Extensions subsystem, which mediates what extensions and web content may request from privileged browser surfaces. Chrome enforces a boundary between untrusted web origins and internal chrome:// pages that expose sensitive settings, storage, and browser APIs. The authorization check that governs this boundary is applied incorrectly, allowing crafted HTML to reach an internal privileged page it should not be able to access. Once inside a privileged context, a remote attacker gains capabilities normally reserved for browser-internal code. The issue is classified as CWE-863: Incorrect Authorization.

Root Cause

The underlying defect is an incorrect authorization decision in how the Extensions component validates access to privileged pages. The check either evaluates the wrong principal, uses an insufficient predicate, or is bypassed under specific navigation flows involving extension-mediated content. As a result, code paths that should be reachable only by trusted browser components accept requests originating from web content.

Attack Vector

Exploitation requires no privileges and no user interaction beyond loading a page. An attacker hosts a crafted HTML document on any web server, then lures a Chrome user to visit the URL through phishing, malvertising, or a compromised site. The page issues navigation or extension interaction sequences that trigger the flawed authorization path, landing the attacker's script inside a privileged Chrome page. Because the attack is remote and network-based, it scales to any Chrome user browsing the internet with a vulnerable build. See the Chromium Issue Tracker entry for upstream details.

Detection Methods for CVE-2026-87544

Indicators of Compromise

Chrome renderer or browser processes navigating to chrome:// URLs shortly after loading an untrusted external page
Extension activity records that show interactions with privileged pages initiated from web-origin frames
Unexpected changes to browser settings, installed extensions, or stored credentials following a browsing session

Detection Strategies

Inventory endpoint Chrome versions and flag any host running a build below 153.0.8010.36
Correlate web proxy logs with endpoint process telemetry to identify sessions where a browsing event preceded suspicious extension or settings changes
Alert on child process creation from chrome.exe that deviates from baseline, particularly spawns tied to newly installed or modified extensions

Monitoring Recommendations

Enable enterprise browser reporting through Chrome Browser Cloud Management to centralize extension install and update events
Monitor DNS and HTTP telemetry for repeated visits to low-reputation domains delivering HTML with unusual iframe or extension messaging patterns
Track Chrome update compliance continuously and generate tickets for endpoints that fall behind the patched version

How to Mitigate CVE-2026-87544

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints
Restart Chrome on every endpoint after the update so the patched binaries load into memory
Audit installed browser extensions and remove any that are unnecessary, unsigned, or from unverified publishers

Patch Information

Google released a fix in Chrome Stable version 153.0.8010.36. Deployment details are documented in the Chrome Desktop Update Announcement. Chromium-based browsers should pull the upstream fix referenced in the Chromium Issue Tracker entry and ship an aligned release. Enterprises using Chrome Browser Cloud Management or group policy should enforce the minimum version through managed update policies.

Workarounds

Restrict extension installation to an allowlist through the ExtensionInstallAllowlist and ExtensionInstallBlocklist policies until patching is complete
Enforce Safe Browsing Enhanced Protection to reduce exposure to crafted HTML delivered from malicious sites
Block access to known malicious domains at the DNS or proxy layer to reduce the likelihood users reach exploit pages

bash

# Configuration example: Chrome enterprise policy to enforce minimum version and restrict extensions (Linux managed policy JSON)
{
  "TargetVersionPrefix": "153.0.8010.36",
  "ExtensionInstallBlocklist": ["*"],
  "ExtensionInstallAllowlist": [
    "<approved-extension-id-1>",
    "<approved-extension-id-2>"
  ],
  "SafeBrowsingProtectionLevel": 2
}