CVE-2026-87556: Google Chrome Auth Bypass Vulnerability

CVE-2026-87556 Overview

CVE-2026-87556 is a missing authorization vulnerability in the Browser component of Google Chrome prior to version 153.0.8010.36. A remote attacker can bypass system access restrictions by serving a crafted HTML page to a targeted user. The flaw is tracked as CWE-862: Missing Authorization and carries a Chromium security severity rating of Medium. Exploitation requires user interaction, such as visiting an attacker-controlled page. Successful exploitation impacts integrity by permitting actions that should have been gated by access control checks. Google addressed the issue in the Chrome Stable channel via the Stable Channel Update for Desktop.

Critical Impact
A remote attacker can bypass browser access restrictions through a crafted HTML page, enabling integrity-impacting actions that circumvent Chrome's authorization checks.

Affected Products

Google Chrome Desktop versions prior to 153.0.8010.36
Chromium-based browsers incorporating the vulnerable Browser component
Deployments on Windows, macOS, and Linux running affected Chrome builds

Discovery Timeline

2026-09-09 - CVE-2026-87556 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87556

Vulnerability Analysis

The vulnerability resides in Chrome's Browser process, which mediates privileged operations for renderer processes and web content. A missing authorization check allows a crafted HTML page to invoke functionality that should be restricted by system access controls. Because the attack originates from web content, no prior authentication or local access is required. The user must open or interact with the malicious page for exploitation to succeed. The scope of impact is limited to integrity effects; confidentiality and availability are not directly affected according to the published CVSS vector.

Root Cause

The root cause is a missing authorization check (CWE-862) in a Browser-process code path. The affected handler executes a sensitive operation without first verifying that the caller or origin holds the required permission. This defect enables web content to reach functionality intended to be gated by Chrome's system access restrictions. Full technical details are tracked in the Chromium Issue Tracker entry.

Attack Vector

Exploitation is network-based and delivered through a crafted HTML page. An attacker hosts the payload on a controlled site or injects it into a page loaded by the target. When the victim visits the page and performs the required interaction, the crafted content triggers the unauthorized code path in the Browser process. The result is a bypass of system access restrictions enforced by Chrome. No local privileges or additional software are required on the victim host.

No public proof-of-concept code is available. Refer to the Chromium Issue Tracker entry once access restrictions on the report are lifted for reproduction details.

Detection Methods for CVE-2026-87556

Indicators of Compromise

Chrome browser processes on endpoints running versions prior to 153.0.8010.36
Outbound web requests to newly registered or low-reputation domains hosting HTML content that triggers unexpected browser-mediated actions
Browser telemetry showing invocation of privileged APIs from untrusted origins without preceding permission prompts

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build earlier than 153.0.8010.36
Correlate browser process activity with network telemetry to identify HTML-delivered attempts to invoke restricted functionality
Monitor endpoint detection and response logs for anomalous child processes or file system changes originating from chrome.exe after visits to untrusted sites

Monitoring Recommendations

Ingest Chrome update and version telemetry into a centralized data lake to track patch adoption over time
Alert on installations that remain on vulnerable Chrome builds beyond the organization's patch SLA
Baseline browser-initiated permission-sensitive actions and alert on deviations that could indicate authorization bypass attempts

How to Mitigate CVE-2026-87556

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints
Force-restart Chrome after the update so the patched Browser process is loaded
Validate patch deployment by querying installed browser versions across the fleet and remediating stragglers

Patch Information

Google released the fix in the Chrome Stable channel. Details are provided in the Stable Channel Update for Desktop. Chromium-based browser vendors should incorporate the upstream fix and issue corresponding updates. Enterprises using managed Chrome deployments should verify that automatic updates are enabled and unblocked by proxy or update-server policies.

Workarounds

Restrict browsing to trusted sites using enterprise URL allowlists until patch deployment is confirmed
Enable Chrome's Enhanced Safe Browsing to increase warnings on suspicious HTML content
Educate users to avoid interacting with unsolicited links, since exploitation requires user interaction

bash

# Verify installed Chrome version on Windows endpoints
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Verify installed Chrome version on macOS endpoints
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString

# Verify installed Chrome version on Linux endpoints
google-chrome --version