CVE-2026-87566: Google Chrome Information Disclosure Flaw

CVE-2026-87566 Overview

CVE-2026-87566 is an observable discrepancy vulnerability in the Layout component of Google Chrome. The flaw affects Chrome versions prior to 153.0.8010.36 and allows a remote attacker to leak sensitive information through a crafted HTML page. The issue is classified under [CWE-203: Observable Discrepancy], a side-channel weakness where behavioral differences in application processing expose information to unauthorized parties. Google's Chromium security team rated the underlying issue as Medium severity.

Critical Impact
A remote attacker can lure a user into visiting a malicious page and infer sensitive cross-origin information by observing timing or layout-based discrepancies in Chrome's rendering pipeline.

Affected Products

Google Chrome Desktop (Stable channel) prior to 153.0.8010.36
Chromium-based browsers sharing the vulnerable Layout code path
All supported desktop platforms (Windows, macOS, Linux) running affected Chrome builds

Discovery Timeline

2026-09-09 - CVE-2026-87566 published to the National Vulnerability Database
2026-09-09 - Google publishes Stable Channel update fixing the issue
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87566

Vulnerability Analysis

The vulnerability resides in Chrome's Layout engine, the subsystem responsible for computing the visual position and size of DOM elements. An observable discrepancy occurs when the browser exposes measurable differences in behavior that depend on cross-origin or otherwise protected state.

An attacker who controls an HTML page can trigger layout operations that vary based on the presence, content, or attributes of resources the user is authorized to access elsewhere. By measuring the resulting differences, such as render timing or induced side effects, the attacker infers sensitive information without directly reading it.

Exploitation requires user interaction, specifically the victim opening or interacting with the attacker-controlled page. The attack complexity is high because reliable exploitation depends on precise measurement conditions and browser state. No public proof-of-concept, exploit code, or in-the-wild abuse has been reported, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is a design-level information leak in the Layout component where cross-origin or protected state influences observable rendering behavior. This is a classic [CWE-203] side-channel pattern rather than a memory corruption issue. Google's security fix in Chrome 153.0.8010.36 removes the discrepancy so that layout operations no longer reveal sensitive state to script running on an attacker-controlled origin.

Attack Vector

The attack vector is network-based and delivered through a crafted HTML page. A typical scenario involves an attacker hosting a malicious site, or injecting malicious content into a compromised site, and enticing the target to visit it. The page executes script that instruments layout operations and measures the resulting side effects to extract information. No authentication is required, and the attacker does not need any prior privileges on the target system.

Because no verified public proof-of-concept exists, technical exploitation details are limited to the vendor advisory. Refer to the Google Chrome Releases advisory and Chromium Issue Tracker #540021850 for further context as Google releases additional details.

Detection Methods for CVE-2026-87566

Indicators of Compromise

Endpoints running Chrome builds earlier than 153.0.8010.36 observed in browser telemetry or software inventory
Web traffic to unfamiliar domains hosting HTML pages that perform intensive layout measurements, requestAnimationFrame timing loops, or repeated CSS style recalculations
Browser process activity correlated with visits to suspicious ad networks or newly registered domains delivering unusually complex rendering payloads

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any instance below 153.0.8010.36 as vulnerable
Monitor DNS and proxy logs for outbound connections to low-reputation domains, and correlate them with browser process telemetry
Alert on Chrome installations that fail to auto-update within the organization's expected patch window

Monitoring Recommendations

Ingest endpoint browser version data into a centralized data lake and build queries that surface out-of-date Chrome installations
Track Google's Chrome Releases feed and map new advisories to internal vulnerability management workflows
Correlate web proxy logs with endpoint identifications to detect users who visited suspicious pages before patching

How to Mitigate CVE-2026-87566

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all Windows, macOS, and Linux endpoints
Restart Chrome on end-user devices to ensure the patched binary is loaded into memory
Verify that enterprise auto-update policies are enabled and not blocked by group policy or network filtering
Audit Chromium-based browsers and embedded WebViews in the environment and apply vendor updates as they become available

Patch Information

Google released the fix in the Chrome Stable channel version 153.0.8010.36. The update is distributed through Chrome's built-in updater and enterprise deployment channels. Details are published in the Google Chrome Stable Channel Update, with additional context available in Chromium Issue Tracker #540021850.

Workarounds

No vendor-supplied workaround exists; upgrading to the patched Chrome version is the only complete remediation
Restrict browsing to trusted sites via enterprise web filtering to reduce exposure to crafted HTML pages until patching is complete
Enforce Site Isolation and cross-origin protections through enterprise policy to reduce the impact of cross-origin side channels

bash

# Verify installed Chrome version on Linux/macOS
google-chrome --version

# Windows PowerShell: query installed Chrome version
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# Enterprise policy: ensure auto-update is enabled (Windows registry)
reg add "HKLM\SOFTWARE\Policies\Google\Update" /v UpdateDefault /t REG_DWORD /d 1 /f