CVE-2026-87560: Google Chrome Auth Bypass Vulnerability

CVE-2026-87560 Overview

CVE-2026-87560 is a missing authorization vulnerability [CWE-862] in the Browser component of Google Chrome. Versions prior to 153.0.8010.36 fail to enforce system access restrictions. A remote attacker can exploit the flaw by serving a crafted HTML page to a targeted user. Successful exploitation lets the attacker bypass browser-enforced access controls without authentication. Chromium classifies the security severity as Medium. Google addressed the issue in the Stable channel update released in September 2026.

Critical Impact
A remote attacker can bypass system access restrictions in Chrome by tricking a user into loading a crafted HTML page, undermining browser trust boundaries.

Affected Products

Google Chrome versions prior to 153.0.8010.36
Chromium-based browsers sharing the vulnerable Browser component
Desktop platforms covered by the Chrome Stable channel update

Discovery Timeline

2026-09-09 - CVE-2026-87560 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87560

Vulnerability Analysis

The vulnerability resides in the Browser process of Google Chrome, which mediates access between untrusted web content and system resources. The Browser component fails to perform a required authorization check before permitting an action reserved for privileged contexts. A crafted HTML page can trigger the missing check and reach functionality that should be gated by system access controls.

Exploitation requires user interaction, typically visiting an attacker-controlled page. No authentication or elevated privileges are required on the target. The impact is limited to an integrity breach within the browser trust model; confidentiality and availability are not directly affected according to the vendor scoring.

The Chromium project tracks the underlying defect in issue 511824746. Google published the fix through the Stable channel update for desktop.

Root Cause

The defect is a missing authorization check [CWE-862] in the Browser component. Code paths that should validate the caller's origin or capability against the requested action instead proceed without verification. This lets web-origin content invoke behavior that the security model intends to restrict to trusted callers.

Attack Vector

The attack vector is network-based. An attacker hosts a crafted HTML page and lures the victim to visit it through phishing, malvertising, or a compromised site. When the page loads in an unpatched Chrome build, JavaScript or HTML content triggers the vulnerable Browser code path and bypasses the intended access restriction. No further user action beyond page rendering is required.

No public proof-of-concept has been published, and the exploit is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Chromium Issue Tracker #511824746 for technical details as they become available.

Detection Methods for CVE-2026-87560

Indicators of Compromise

Chrome desktop clients reporting a version string below 153.0.8010.36 in browser telemetry or software inventory.
Outbound web traffic to newly registered or low-reputation domains coinciding with unexpected browser-initiated system activity.
Unusual child processes or file writes spawned from chrome.exe following visits to untrusted pages.

Detection Strategies

Inventory installed Chrome builds across managed endpoints and flag versions earlier than 153.0.8010.36.
Correlate web proxy logs with endpoint process telemetry to identify page loads that immediately precede anomalous browser behavior.
Alert on browser access to system resources or protocols that policy does not sanction for standard user sessions.

Monitoring Recommendations

Ingest browser version telemetry into the SIEM and build a dashboard tracking patch compliance against 153.0.8010.36.
Monitor endpoint detection and response (EDR) telemetry for suspicious child processes, script execution, or file activity originating from Chrome.
Track user reports of unexpected browser prompts, downloads, or permission grants that may indicate exploitation attempts.

How to Mitigate CVE-2026-87560

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints.
Restart browser sessions after the update to ensure the patched binaries are loaded.
Prioritize patching for users with elevated privileges, developer roles, or access to sensitive data.

Patch Information

Google released the fix in the Chrome Stable channel update documented in the Google Chrome Stable Update advisory. Administrators should confirm that automatic updates are enabled and verify deployment through enterprise management tooling such as Chrome Browser Cloud Management or Group Policy.

Workarounds

Enforce Chrome auto-update policies and restrict use of outdated builds through enterprise policy.
Restrict browsing to trusted sites using web filtering or DNS-layer controls until patching is complete.
Educate users to avoid clicking unsolicited links and to report unexpected browser behavior to the security team.

bash

# Verify installed Chrome version on Windows via Group Policy inventory
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Verify installed Chrome version on macOS
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString

# Verify installed Chrome version on Linux
google-chrome --version