CVE-2026-87569: Google Chrome Auth Bypass Vulnerability

CVE-2026-87569 Overview

CVE-2026-87569 is a missing authorization vulnerability in the Views component of Google Chrome prior to version 153.0.8010.36. A remote attacker can bypass system access restrictions by convincing a user to visit a crafted HTML page. The flaw is classified under CWE-862: Missing Authorization and requires user interaction, but no privileges, to exploit. Google's Chromium project rated the underlying security severity as High. Successful exploitation can compromise confidentiality, integrity, and availability on affected systems.

Critical Impact
Attackers can bypass Chrome's system access restrictions through social engineering, gaining elevated impact on the browser and potentially the host environment.

Affected Products

Google Chrome (Desktop) prior to 153.0.8010.36
Chromium-based browsers sharing the vulnerable Views component
Enterprise deployments of Chrome not updated to the Stable channel release

Discovery Timeline

2026-09-09 - CVE-2026-87569 published to the National Vulnerability Database
2026-09-10 - Last updated in the NVD database
Vendor advisory - Google Chrome Stable Channel Update for Desktop

Technical Details for CVE-2026-87569

Vulnerability Analysis

The vulnerability resides in Chrome's Views UI framework, which renders and manages browser windows, dialogs, and other user-interface elements. A missing authorization check allows a crafted HTML page to invoke functionality that should be gated by user consent or origin-based restrictions. Because the Views layer mediates interactions between web content and browser chrome, missing checks can let attacker-controlled pages influence trusted UI paths. Exploitation requires the victim to load a malicious page, typically delivered through phishing, malvertising, or a compromised site.

Root Cause

The root cause is an absent authorization check (CWE-862) in a Views-managed code path. The affected function does not verify that the calling context has permission to perform a security-relevant operation. This gap allows web content to trigger actions that should be restricted to trusted browser components.

Attack Vector

Exploitation is remote and network-based. The attacker hosts a crafted HTML page and lures a user to visit it. Once loaded, the page invokes the unprotected Views operation to bypass Chrome's access restrictions. No authentication is required, but user interaction is necessary. Refer to Chromium Issue Tracker #523277481 for the constrained technical disclosure.

No verified proof-of-concept code is publicly available.
See the Chromium issue tracker for restricted technical details.

Detection Methods for CVE-2026-87569

Indicators of Compromise

Chrome browser processes on endpoints running versions earlier than 153.0.8010.36
Unexpected child processes or file writes originating from chrome.exe following browsing sessions
User reports of unusual browser prompts, dialogs, or permission changes after visiting external links

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build below 153.0.8010.36
Correlate browser telemetry with proxy or DNS logs to identify visits to newly registered or low-reputation domains that deliver HTML payloads
Monitor for anomalous inter-process activity spawned by the Chrome renderer or browser process

Monitoring Recommendations

Enable enterprise Chrome reporting and forward events to a centralized SIEM for version and policy compliance tracking
Alert on endpoints that fail to receive Chrome auto-updates within the vendor's Stable channel release window
Track social-engineering indicators such as phishing URLs that reference browser update themes or fake system dialogs

How to Mitigate CVE-2026-87569

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all Windows, macOS, and Linux endpoints
Force-restart Chrome after deployment so the patched binaries are loaded into memory
Validate that Chrome auto-update services are running and not blocked by group policy or network controls

Patch Information

Google addressed CVE-2026-87569 in the Stable channel update announced in the Google Chrome Stable Channel Update for Desktop. Administrators should deploy Chrome 153.0.8010.36 or later. Chromium-based browsers should apply the corresponding upstream fix once vendors publish updated builds.

Workarounds

Restrict browsing to trusted sites through enterprise web filtering until patches are deployed
Enforce user-awareness guidance to avoid clicking unsolicited links, since exploitation requires user interaction
Apply Chrome enterprise policies that limit high-risk features and mandate the latest Stable channel build

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Windows: query installed version via registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version