CVE-2026-87549: Google Chrome Auth Bypass Vulnerability

CVE-2026-87549 Overview

CVE-2026-87549 is an incomplete cleanup vulnerability [CWE-459] in the Downloads component of Google Chrome versions prior to 153.0.8010.36. A remote attacker can leverage social engineering with a crafted HTML page to bypass system access restrictions. The flaw affects the browser's handling of downloaded content, leaving residual state that can be abused to circumvent security boundaries. Google's Chromium security team classifies the severity as Medium. Exploitation requires user interaction, meaning the victim must engage with the malicious page or downloaded file for the attack to succeed.

Critical Impact
Successful exploitation enables an attacker to bypass system access restrictions, potentially placing or modifying files outside intended download boundaries through user-facing social engineering.

Affected Products

Google Chrome Desktop versions prior to 153.0.8010.36
Chromium-based builds sharing the vulnerable Downloads component
Stable channel Chrome installations on supported desktop platforms

Discovery Timeline

2026-09-09 - CVE-2026-87549 published to the National Vulnerability Database (NVD)
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87549

Vulnerability Analysis

The vulnerability resides in Chrome's Downloads subsystem. The component fails to fully clean up state or resources associated with a download operation. This incomplete cleanup [CWE-459] leaves the browser in a state where system access restrictions can be bypassed. An attacker must convince the user to interact with a crafted HTML page, aligning with the user interaction requirement in the CVSS vector. The integrity impact is high because a successful attack allows the attacker to write or alter data outside the intended scope. Confidentiality and availability are not directly affected according to the published metrics.

Root Cause

The root cause is incomplete resource or state cleanup within the Downloads handling code path. When a download completes, is canceled, or transitions between states, residual artifacts remain in a form the attacker can influence. This condition allows a crafted page to manipulate the download flow and evade access control checks that normally constrain file placement or execution context.

Attack Vector

The attack is delivered over the network through a crafted HTML page. The attacker hosts the page on a domain the victim visits or reaches through a phishing lure. User interaction is required — typically clicking a link, confirming a download, or interacting with an in-page element. Once the download flow is triggered, the incomplete cleanup enables the bypass of system access restrictions. No prior authentication to the browser or the attacker's site is required.

No public proof-of-concept, exploit code, or exploitation-in-the-wild reporting is available for CVE-2026-87549 at this time. Refer to the Chromium Issue #516534546 tracker for technical detail as Google releases it.

Detection Methods for CVE-2026-87549

Indicators of Compromise

Chrome browser versions below 153.0.8010.36 running on endpoints after the patch release date
Unexpected files appearing in locations outside the standard Chrome downloads directory following browser sessions
Browser process activity writing to protected paths shortly after a user visits an unfamiliar HTML page

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any build below 153.0.8010.36
Correlate web proxy logs with endpoint file-creation events to identify suspicious download-to-write chains originating from newly visited domains
Monitor for Chrome child processes or helper processes touching sensitive filesystem locations that are outside expected download paths

Monitoring Recommendations

Enable telemetry on file-write operations performed by chrome.exe and its renderer or utility processes
Alert on Chrome downloads that resolve to executable or script file types delivered from low-reputation domains
Track user interaction patterns with HTML content served over HTTP or from newly registered domains, which are common in social engineering campaigns

How to Mitigate CVE-2026-87549

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all desktop endpoints
Verify auto-update is enabled and functioning for managed Chrome installations
Communicate phishing awareness guidance to users, emphasizing caution with unsolicited download prompts

Patch Information

Google released the fix in the Chrome Stable channel update announced in the Google Chrome Desktop Update. Upgrading to Chrome 153.0.8010.36 or later remediates the incomplete cleanup condition in the Downloads component. Enterprise administrators should push the update through their standard software distribution mechanism and confirm rollout across all managed devices.

Workarounds

Restrict download destinations using enterprise Chrome policies such as DownloadDirectory and DownloadRestrictions
Enforce SmartScreen or equivalent file-reputation checks on downloaded content at the endpoint and network gateway
Apply application allow-listing to prevent execution of files written to non-standard locations by browser processes

bash

# Example Chrome enterprise policy to restrict dangerous downloads (Linux JSON policy)
{
  "DownloadRestrictions": 3,
  "DownloadDirectory": "${user_home}/Downloads",
  "PromptForDownloadLocation": true
}