CVE-2026-87548: Google Chrome Auth Bypass Vulnerability

CVE-2026-87548 Overview

CVE-2026-87548 is an improper state validation vulnerability in the Installer component of Google Chrome prior to version 153.0.8010.36. A remote attacker can bypass system access restrictions by luring a user to a crafted HTML page. The Chromium project rates the security severity as Medium. The flaw is tracked under CWE-754: Improper Check for Unusual or Exceptional Conditions and requires user interaction to trigger. No public exploit code or in-the-wild exploitation has been reported.

Critical Impact
A crafted HTML page can cause the Chrome Installer to bypass system access restrictions, enabling limited integrity impact against affected hosts.

Affected Products

Google Chrome Desktop (Stable channel) prior to 153.0.8010.36
Chromium-based builds incorporating the vulnerable Installer component
Windows, macOS, and Linux installations pending automatic update

Discovery Timeline

2026-09-09 - CVE-2026-87548 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database
2026-09 - Google releases fixed Chrome Stable channel per the Chrome Releases advisory

Technical Details for CVE-2026-87548

Vulnerability Analysis

The defect resides in the Chrome Installer, which fails to correctly validate its internal state during specific execution paths. When a user visits an attacker-controlled HTML page that invokes Installer behavior, the missing state check allows the flow to proceed under conditions the Installer would normally reject. This produces a bypass of system access restrictions that Chrome enforces around Installer operations. Exploitation requires the victim to load attacker content in the browser, and the resulting impact is limited to integrity, with no direct confidentiality or availability loss reported.

Root Cause

The root cause is an improper check for an exceptional condition inside the Installer, classified as CWE-754. The component assumes prerequisite state transitions have completed successfully without verifying them, so a maliciously constructed sequence originating from a web page can drive the Installer into a state where access checks no longer apply. The Chromium fix hardens the state validation logic in the Installer path, as described in the Chromium Issue Tracker #513495219.

Attack Vector

Exploitation is network-based and interactive. An attacker hosts a crafted HTML page and induces a Chrome user on a vulnerable build to visit it, typically via phishing, malvertising, or a compromised site. Once loaded, the page triggers the Installer code path with parameters that skip or corrupt the expected state transitions. Because the flaw is in the Installer, successful abuse focuses on bypassing controls that gate installation-adjacent operations rather than achieving direct code execution. Refer to the Google Chrome Stable channel update for the vendor's account of the fix.

No verified proof-of-concept has been published, so a technical exploitation walkthrough is not included here.

Detection Methods for CVE-2026-87548

Indicators of Compromise

Chrome Installer processes (setup.exe, GoogleUpdate.exe, or platform equivalents) spawned in unexpected user or timing contexts following browser activity
Modifications to Chrome installation directories or update channels immediately after web navigation events
Unexpected registry writes under HKCU\Software\Google\Update or platform-equivalent update state stores on hosts still running builds below 153.0.8010.36

Detection Strategies

Inventory Chrome versions across the fleet and flag any endpoint reporting a version below 153.0.8010.36.
Correlate browser process telemetry with Installer process launches to identify anomalous parent-child relationships originating from tab-hosted content.
Alert on Installer binaries executing without a corresponding scheduled update task or user-initiated install action.

Monitoring Recommendations

Ingest endpoint process, file, and registry telemetry into a centralized data lake to enable retroactive hunting once additional indicators emerge.
Track EPSS movement for CVE-2026-87548 and re-prioritize patching if exploit probability increases.
Monitor the Chromium Issue Tracker entry for public disclosure of exploitation details.

How to Mitigate CVE-2026-87548

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all Windows, macOS, and Linux endpoints.
Restart Chrome after the update to ensure the patched Installer binaries are loaded.
Verify enterprise update policies are not pinning Chrome to an older channel or blocking automatic updates.

Patch Information

Google addressed CVE-2026-87548 in the Chrome Stable channel release documented in the Chrome Releases advisory. Administrators managing Chrome via Group Policy, Jamf, or equivalent tooling should confirm that the minimum enforced version is 153.0.8010.36 or higher. The fix hardens state validation inside the Installer component so that crafted web content can no longer drive it into an unchecked state.

Workarounds

Restrict user browsing to trusted destinations via web filtering until Chrome is fully updated.
Disable or restrict Chrome Installer execution outside of managed update windows using application control policies.
Enforce least-privilege user accounts to reduce the impact of any Installer state bypass.