CVE-2026-87551: Google Chrome Auth Bypass Vulnerability

CVE-2026-87551 Overview

CVE-2026-87551 is an improper certificate validation vulnerability in the Cross-Origin Resource Sharing (CORS) implementation of Google Chrome prior to version 153.0.8010.36. A remote attacker can bypass the web origin policy by delivering crafted network traffic to a user who is convinced through social engineering to interact with attacker-controlled content. Chromium classifies the underlying security severity as Low, and the flaw is tracked under CWE-295: Improper Certificate Validation. The issue affects Chrome on all supported desktop platforms and is resolved in the stable channel update referenced by Google.

Critical Impact
An attacker leveraging social engineering can bypass the same-origin protections enforced by CORS, enabling limited cross-origin data manipulation against users of unpatched Chrome installations.

Affected Products

Google Chrome desktop versions prior to 153.0.8010.36
Chromium-based browsers that inherit the vulnerable CORS certificate validation logic
Enterprise deployments of Chrome that have not yet applied the stable channel update

Discovery Timeline

2026-09-09 - CVE-2026-87551 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87551

Vulnerability Analysis

The vulnerability resides in how Chrome validates TLS certificates during CORS preflight and cross-origin resource requests. CORS is the browser mechanism that governs which origins may read responses from another origin. When certificate validation is not enforced correctly during these cross-origin exchanges, the browser can accept responses that should have been rejected as untrusted. This weakens the same-origin boundary that web applications depend on for confidentiality and integrity of user data. The flaw requires user interaction, which aligns with the social engineering precondition described in the advisory.

Root Cause

The root cause is improper certificate validation within Chrome's CORS handling code path, mapped to [CWE-295]. The browser fails to correctly bind the trust decision on a server certificate to the origin policy enforcement performed by CORS. As a result, a crafted response can be accepted as originating from a trusted origin even when the certificate chain does not support that conclusion. Details are tracked in the Chromium Issue Tracker #540070236.

Attack Vector

An attacker hosts malicious content and lures a victim to interact with it, typically by clicking a link or loading an attacker-controlled page. The page issues cross-origin requests whose responses are shaped to exploit the certificate validation gap. Because the attack vector is network-based and does not require privileges, any user session running a vulnerable Chrome build is exposed once interaction occurs. No public proof-of-concept exploit or exploitation in the wild has been reported at the time of publication.

No verified exploit code is available. Refer to the Chromium Issue Tracker #540070236 for technical details as the report is opened by Google.

Detection Methods for CVE-2026-87551

Indicators of Compromise

Chrome browser processes making outbound TLS connections to domains presenting mismatched or untrusted certificates immediately after a user clicks an external link
Web proxy or TLS inspection logs recording CORS preflight (OPTIONS) requests followed by cross-origin GET or POST traffic to newly registered or low-reputation domains
Endpoint telemetry showing Chrome versions below 153.0.8010.36 in active use across the environment

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build earlier than 153.0.8010.36 for remediation tracking
Correlate browser process telemetry with DNS and TLS logs to identify cross-origin requests to domains with certificate anomalies
Monitor phishing and social engineering indicators in email gateways, since user interaction is required for exploitation

Monitoring Recommendations

Enable TLS certificate validation logging on egress proxies to surface untrusted or self-signed certificates presented to browser clients
Track browser version telemetry continuously and alert when unpatched Chrome installations reappear after remediation
Ingest browser and network telemetry into a centralized data lake to enable retrospective hunting for cross-origin abuse patterns

How to Mitigate CVE-2026-87551

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all Windows, macOS, and Linux endpoints
Restart Chrome after installation so that the updated binaries and network stack take effect for every user session
Verify that enterprise policy does not pin Chrome to an older channel that would block the fix from deploying

Patch Information

Google addressed CVE-2026-87551 in the Chrome stable channel update announced on the Google Chrome Releases blog. The fixed build is 153.0.8010.36 for desktop platforms. Chromium-based browsers should apply the corresponding upstream patch as their vendors publish updates.

Workarounds

Deliver user awareness reminders about clicking unsolicited links, since exploitation requires user interaction
Enforce browser update policies through mobile device management or group policy so that stable channel updates install automatically
Restrict browsing to known-good categories through a secure web gateway for high-risk user populations until patching completes

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Windows: query the installed Chrome version from the registry
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv