CVE-2026-87561: Google Chrome Auth Bypass Vulnerability

CVE-2026-87561 Overview

CVE-2026-87561 is an incorrect authorization vulnerability in the Web Authentication component of Google Chrome. The flaw affects versions prior to 153.0.8010.36 and permits a remote attacker to bypass web origin policy through a crafted Chrome extension. Google Chromium rates the underlying security severity as Low, while the NVD scoring places the issue in the medium range. Successful exploitation requires user interaction, typically the installation of a malicious extension. The vulnerability is tracked under CWE-863: Incorrect Authorization.

Critical Impact
A crafted Chrome extension can bypass Web Authentication origin checks, breaking the trust boundary that isolates credentials to their intended web origin.

Affected Products

Google Chrome (Desktop) versions prior to 153.0.8010.36
Chromium-based browsers sharing the vulnerable Web Authentication code path
Environments permitting installation of untrusted Chrome extensions

Discovery Timeline

2026-09-09 - CVE-2026-87561 published to NVD
2026-09-09 - Google releases Stable Channel update for Desktop addressing the issue
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87561

Vulnerability Analysis

The vulnerability resides in Chrome's Web Authentication (WebAuthn) implementation. WebAuthn binds public-key credentials to a specific Relying Party ID, typically derived from the web origin invoking the API. Chrome enforces authorization checks to ensure only the correct origin can request assertions or registrations for a given credential.

In affected versions, Chrome does not correctly enforce these authorization checks when a Chrome extension participates in the WebAuthn flow. A crafted extension can invoke or influence WebAuthn operations in a manner that bypasses the same-origin restriction on credential usage. This breaks the origin isolation model WebAuthn depends on to prevent credential misuse across sites.

The issue requires user interaction, meaning a victim must install the malicious extension before exploitation is possible. Impact is limited to integrity of the WebAuthn authorization boundary; confidentiality and availability are not directly affected according to the CVSS vector.

Root Cause

The root cause is an incorrect authorization check (CWE-863) in the Web Authentication code path. Chrome's logic fails to sufficiently validate that an extension-initiated or extension-influenced WebAuthn request respects the web origin policy tied to the target credential. As a result, the browser accepts operations that should be rejected on origin grounds.

Attack Vector

An attacker distributes a crafted Chrome extension through the Chrome Web Store, sideloading, or social engineering. Once the victim installs and grants the extension the required permissions, the extension issues WebAuthn calls that would normally be blocked by origin enforcement. The attacker can then interact with credentials in a way that violates the intended relying-party scope. See the Chromium Issue #499217288 and the Google Chrome Stable Update for vendor details.

Detection Methods for CVE-2026-87561

Indicators of Compromise

Chrome browser versions reporting a build lower than 153.0.8010.36 on managed endpoints
Newly installed or sideloaded Chrome extensions that declare webAuthenticationProxy, identity, or broad host permissions without clear business justification
Extension update manifests loaded from non-Web Store origins on user profiles

Detection Strategies

Inventory installed Chrome extensions across the fleet and compare against an approved allowlist
Alert on Chrome process telemetry indicating extension installation events outside centrally managed policy
Review browser version telemetry to identify endpoints running Chrome builds prior to 153.0.8010.36

Monitoring Recommendations

Enable Chrome Enterprise reporting to forward extension install, update, and permission events to a centralized log platform
Correlate WebAuthn registration and assertion events with the originating extension IDs where available
Monitor endpoint EDR telemetry for Chrome child processes spawned in association with unknown extension IDs

How to Mitigate CVE-2026-87561

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all managed and unmanaged endpoints
Audit installed Chrome extensions and remove those without a documented business need
Restrict extension installation to a managed allowlist using Chrome Enterprise policy

Patch Information

Google addressed CVE-2026-87561 in the Chrome Stable Channel update announced on the Chrome Releases blog. Upgrading to Chrome 153.0.8010.36 or later eliminates the vulnerable authorization path. Additional technical context is available in Chromium Issue #499217288.

Workarounds

Deploy the ExtensionInstallAllowlist and ExtensionInstallBlocklist Chrome Enterprise policies to prevent installation of unapproved extensions
Disable developer mode and sideloading of extensions on managed devices via the DeveloperToolsAvailability policy
Educate users to avoid installing browser extensions from untrusted sources until patching is complete

bash

# Chrome Enterprise policy example (Linux JSON policy)
# /etc/opt/chrome/policies/managed/extension_controls.json
{
  "ExtensionInstallBlocklist": ["*"],
  "ExtensionInstallAllowlist": [
    "<approved-extension-id-1>",
    "<approved-extension-id-2>"
  ],
  "DeveloperToolsAvailability": 2
}