CVE-2026-87550: Google Chrome XSS Vulnerability

CVE-2026-87550 Overview

CVE-2026-87550 is a same-origin policy bypass in Google Chrome caused by improper encoding or escaping of output in Cascading Style Sheets (CSS). Versions of Chrome prior to 153.0.8010.36 fail to properly encode CSS output, which allows a remote attacker to potentially bypass the web origin policy through a crafted HTML page. The Chromium project classifies the security severity as Medium. Successful exploitation requires user interaction, such as navigating to a malicious page. The weakness maps to [CWE-116: Improper Encoding or Escaping of Output].

Critical Impact
A remote attacker can leverage a crafted HTML page to bypass origin restrictions and access data that should be isolated between web origins.

Affected Products

Google Chrome versions prior to 153.0.8010.36
Chromium-based browsers using the affected rendering pipeline
Desktop Stable channel installations of Chrome

Discovery Timeline

2026-09-09 - CVE-2026-87550 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87550

Vulnerability Analysis

The vulnerability resides in Chrome's CSS output handling. When the browser processes and emits CSS content, it does not correctly encode or escape values before they cross origin boundaries. An attacker who controls an HTML page can craft CSS constructs that cause the browser to expose or interpret data in a way that violates the same-origin policy.

The same-origin policy is the core web isolation model that prevents scripts and styles from one origin from reading resources served by another. A bypass allows an attacker's origin to observe or influence content from a target origin loaded in the same browser context. In this case, the flaw is scoped to confidentiality impact only, with no direct integrity or availability consequences and no privilege requirements on the attacker side.

Root Cause

The root cause is improper output encoding in the CSS pipeline, tracked as [CWE-116]. Encoding routines fail to neutralize characters or sequences that carry structural meaning across a security boundary. When these unescaped values are emitted into a CSS context, they alter parsing or expose cross-origin data that should be gated by the origin check.

Attack Vector

Exploitation is network-based and requires user interaction. A victim must load an attacker-controlled HTML page in a vulnerable Chrome build. The page delivers crafted CSS designed to trigger the encoding flaw and read information that belongs to another origin loaded in the same rendering context.

No authentication or elevated privileges are required. See the Chromium Issue #518082852 and the Google Chrome Stable Update advisory for vendor context.

Detection Methods for CVE-2026-87550

Indicators of Compromise

Chrome browser version strings below 153.0.8010.36 reported by managed endpoints
Web traffic to unfamiliar domains hosting HTML pages with anomalous inline or imported CSS
Browser telemetry showing cross-origin resource reads immediately after CSS parsing events

Detection Strategies

Inventory Chrome installations across the fleet and flag any build older than 153.0.8010.36 as vulnerable
Inspect network proxy and DNS logs for user navigations preceding suspicious data egress from browser processes
Correlate endpoint browser telemetry with web gateway logs to identify high-risk page loads following external links or email clicks

Monitoring Recommendations

Continuously track Chrome version compliance through configuration management or endpoint tooling
Monitor outbound HTTP requests from browser processes for patterns consistent with cross-origin data exfiltration
Subscribe to the Chrome Releases blog to receive future Stable channel advisories

How to Mitigate CVE-2026-87550

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all desktop endpoints
Force browser relaunch through management tooling to ensure the patched binary is active
Verify Chromium-based third-party browsers have adopted the equivalent upstream fix before allowing use

Patch Information

Google addressed CVE-2026-87550 in the Chrome Stable channel release 153.0.8010.36. Deployment details and channel notes are documented in the Google Chrome Stable Update advisory. Additional engineering context is available in Chromium Issue #518082852.

Workarounds

Restrict browsing to trusted sites through enterprise policy until the patch is deployed
Enable Enhanced Safe Browsing to increase heuristic protection against malicious HTML delivery
Educate users to avoid clicking untrusted links in email, chat, or documents while the fleet is being updated

bash

# Verify installed Chrome version on Linux and macOS endpoints
google-chrome --version

# Windows: query the installed Chrome version from the registry
reg query "HKLM\Software\Google\Chrome\BLBeacon" /v version

# Confirm the reported build is 153.0.8010.36 or higher