CVE-2026-87547: Google Chrome FileSystem RCE Vulnerability

CVE-2026-87547 Overview

CVE-2026-87547 is an incorrect reference resolution vulnerability in the FileSystem component of Google Chrome versions prior to 153.0.8010.36. A remote attacker can leverage a crafted HTML page to potentially execute arbitrary code outside the browser sandbox. Exploitation requires user interaction, typically via social engineering that lures a victim to a malicious web page. The flaw is tracked under CWE-706: Use of Incorrectly-Resolved Name or Reference. Google classified the Chromium security severity as Medium, while the National Vulnerability Database (NVD) scored the issue at 9.6 due to sandbox escape potential and cross-scope impact.

Critical Impact

Successful exploitation permits arbitrary code execution outside the Chrome renderer sandbox, giving attackers a foothold on the underlying operating system from a single visit to a malicious page.

Affected Products

• Google Chrome for Desktop versions prior to 153.0.8010.36
• Chromium-based browsers embedding vulnerable FileSystem code paths
• Downstream distributions bundling pre-patch Chromium builds

Discovery Timeline

• 2026-09-09 - CVE-2026-87547 published to NVD
• 2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87547

Vulnerability Analysis

The vulnerability resides in Chrome's FileSystem implementation, which mediates web-facing access to sandboxed browser storage. Chrome resolves file and directory references before granting operations against them. When the resolution logic returns an incorrect reference, the browser can operate on an object different from the one the security check validated. This mismatch enables an attacker to break out of the renderer sandbox and reach resources normally isolated from untrusted web content.

Exploitation requires the victim to load a crafted HTML page. Because the attack chain crosses the sandbox boundary, the scope changes and impact expands to the host process, matching the confidentiality, integrity, and availability profile of code execution outside the sandbox.

Root Cause

The defect is classified as CWE-706: Use of Incorrectly-Resolved Name or Reference. Chrome's FileSystem layer resolves a supplied name to an internal object, but the resolution does not consistently map to the object subsequently used for privileged operations. An attacker who controls the reference input can steer Chrome into acting on an unintended target, bypassing the origin and sandbox constraints normally enforced on FileSystem entries.

Attack Vector

The attack is network-reachable and requires user interaction. An attacker hosts or injects a crafted HTML page that invokes vulnerable FileSystem APIs with references designed to trigger the mismatched resolution. Social engineering, malvertising, or watering-hole placement is used to bring the victim to the page. Once loaded, the crafted script executes code paths that escape the renderer sandbox and run attacker-controlled code in a higher-privilege browser process context.

No public proof-of-concept is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Chromium Issue Tracker entry for technical details as they become public.

Detection Methods for CVE-2026-87547

Indicators of Compromise

• Chrome browser processes spawning unexpected child processes such as command shells, script interpreters, or rundll32.exe shortly after web navigation.
• Anomalous file writes by Chrome into directories outside its profile and cache paths, particularly to user-writable startup locations.
• Outbound network connections from Chrome-launched processes to newly registered or low-reputation domains hosting HTML payloads.

Detection Strategies

• Inventory installed Chrome versions across the fleet and flag any endpoint running a build older than 153.0.8010.36.
• Alert on Chrome renderer or utility processes performing sandbox-atypical actions such as process injection, token manipulation, or persistence writes.
• Correlate browser telemetry with proxy and DNS logs to identify users who visited suspicious HTML delivery infrastructure preceding suspicious host activity.

Monitoring Recommendations

• Ingest Chrome process lineage and file system telemetry into a centralized analytics platform for cross-host hunting.
• Monitor endpoint detection and response (EDR) alerts tagged to browser exploitation techniques mapped to MITRE ATT&CK T1189 (Drive-by Compromise) and T1203 (Exploitation for Client Execution).
• Track Chrome auto-update rollout status and generate compliance reports for endpoints that fail to install 153.0.8010.36 or later within the maintenance window.

How to Mitigate CVE-2026-87547

Immediate Actions Required

• Update Google Chrome to version 153.0.8010.36 or later on all Windows, macOS, and Linux endpoints.
• Restart Chrome after the update so that the patched binaries are actually loaded; auto-update staging alone does not remediate running instances.
• Prioritize patching for users with administrative privileges, developer workstations, and high-value targets whose compromise would enable lateral movement.

Patch Information

Google addressed the flaw in the Chrome Stable channel release documented in the Stable Channel Update for Desktop. Enterprises using managed Chrome deployments should ensure the update policy permits installation of 153.0.8010.36 or newer. Chromium-based browsers should be updated once their vendors merge and ship the corresponding upstream fix.

Workarounds

• Enforce browser update policies through group policy or mobile device management so users cannot defer critical Chrome updates.
• Restrict navigation to untrusted sites using web content filtering and block newly observed or uncategorized domains at the proxy.
• Educate users to avoid clicking unsolicited links, since exploitation depends on loading an attacker-controlled HTML page.

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Windows: query the installed version via registry
reg query "HKLM\Software\Google\Chrome\BLBeacon" /v version

# macOS: read the CFBundleShortVersionString
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString