CVE-2026-87557 Overview
CVE-2026-87557 is a missing authorization vulnerability [CWE-862] in the LocalNetworkAccess component of Google Chrome versions prior to 153.0.8010.36. The flaw allows a remote attacker who has already compromised the renderer process to bypass system access restrictions using a crafted HTML page. Chromium's security team rated the issue Medium severity. Successful exploitation requires user interaction and prior compromise of the browser's renderer sandbox, limiting scope but expanding post-exploitation options for attackers pivoting toward internal network resources.
Critical Impact
Attackers with renderer-level access can reach local network endpoints that Chrome's Local Network Access controls were designed to isolate, enabling reconnaissance and lateral movement toward internal services.
Affected Products
- Google Chrome versions prior to 153.0.8010.36 (Stable Desktop channel)
- Chromium-based browsers sharing the same LocalNetworkAccess implementation
- Downstream Chromium forks that have not merged the upstream fix
Discovery Timeline
- 2026-09-09 - CVE-2026-87557 published to NVD
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-87557
Vulnerability Analysis
The vulnerability resides in Chrome's Local Network Access (LNA) enforcement path. LNA is designed to gate requests from public web origins toward local or private network destinations, requiring explicit authorization before a page can reach devices on the user's LAN or loopback interface. In affected versions, an authorization check is missing along one execution path, allowing a compromised renderer to issue requests that reach local network destinations without triggering the intended access decision.
Exploitation requires two conditions. First, the renderer process must already be compromised through a separate flaw, such as a memory corruption bug or logic error in web content handling. Second, the attacker must deliver a crafted HTML page that steers the compromised renderer into the unchecked code path. Because user interaction is required, the attack typically pairs with a phishing or drive-by delivery chain.
Root Cause
The root cause is a missing authorization check [CWE-862] in the LocalNetworkAccess component. The affected code path assumes upstream logic has already validated the request against Chrome's Local Network Access policy. When the renderer is compromised, the attacker can construct requests that reach this path without prior validation, defeating the isolation LNA is intended to enforce.
Attack Vector
The attack vector is network-based with required user interaction. An attacker hosts a crafted HTML page and, after compromising the renderer through a separate vector, uses the page to issue requests toward local network resources. The confidentiality impact is none, integrity is low, and availability is not affected. The practical outcome is unauthorized reachability to internal services such as routers, printers, and internal HTTP endpoints. See the Chromium Issue Tracker #497635917 for additional technical context.
Detection Methods for CVE-2026-87557
Indicators of Compromise
- Chrome browser processes originating outbound connections to RFC1918 addresses or localhost shortly after loading external web content.
- Unexpected HTTP requests from browser renderers targeting internal management interfaces or IoT devices.
- Chrome versions below 153.0.8010.36 present in endpoint inventory data after the patch release date.
Detection Strategies
- Correlate browser process telemetry with network flow data to identify renderer processes contacting internal subnets without a corresponding user-initiated navigation.
- Deploy endpoint software inventory checks that flag Chrome installations below 153.0.8010.36.
- Inspect DNS and proxy logs for browser-originated queries resolving to private address space following visits to untrusted domains.
Monitoring Recommendations
- Enable process-to-network correlation on endpoints to associate chrome.exe child processes with destination IP ranges.
- Alert on browser-initiated connections to internal administrative ports such as 80, 443, 8080, and 8443 on RFC1918 ranges.
- Track Chrome version compliance against the patched build across managed endpoints.
How to Mitigate CVE-2026-87557
Immediate Actions Required
- Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints.
- Force a browser restart after deployment to ensure the patched binary is loaded into memory.
- Audit Chromium-based browsers such as Edge, Brave, and Opera for upstream patch adoption.
Patch Information
Google released the fix in the Stable channel update documented in the Google Chrome Stable Update. Administrators should deploy Chrome 153.0.8010.36 or later through enterprise update channels such as Google Update, Microsoft Intune, or Jamf. The fix addresses the missing authorization check in the LocalNetworkAccess enforcement path.
Workarounds
- Restrict outbound browser access to internal network ranges using host-based firewall rules where feasible.
- Enforce enterprise policies that block navigation to untrusted domains until patching is complete.
- Segment user endpoints from sensitive internal management interfaces to reduce the impact of renderer-level compromise.
# Configuration example: verify Chrome version on managed endpoints
google-chrome --version
# Expected output: Google Chrome 153.0.8010.36 or later
# Windows enterprise policy check (PowerShell)
Get-ItemProperty "HKLM:\SOFTWARE\Google\Chrome\BLBeacon" | Select-Object version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
