CVE-2026-87570: Google Chrome Auth Bypass Vulnerability

CVE-2026-87570 Overview

CVE-2026-87570 is an incorrect authorization vulnerability [CWE-863] in the Site Isolation component of Google Chrome. The flaw affects Chrome versions prior to 153.0.8010.36. An attacker who has already compromised the renderer process can bypass Site Isolation boundaries by delivering a crafted file and leveraging social engineering to trick the user into opening it. Successful exploitation allows cross-origin access that Site Isolation is designed to prevent, exposing the confidentiality and integrity of data belonging to other web origins loaded in the browser.

Critical Impact
Attackers who chain this bug with a renderer compromise can break the site-isolation security boundary and access data across web origins in the victim's browser.

Affected Products

Google Chrome for Desktop prior to 153.0.8010.36
Chromium-based browsers embedding the vulnerable Site Isolation code
Chrome deployments across Windows, macOS, and Linux Stable channels

Discovery Timeline

2026-09-09 - CVE-2026-87570 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database
2026-09 - Google releases fixed Chrome build 153.0.8010.36 via the Stable channel update

Technical Details for CVE-2026-87570

Vulnerability Analysis

Site Isolation is a Chrome security architecture that places pages from different sites into separate operating system processes. This boundary limits the impact of a compromised renderer by preventing it from directly reading data belonging to other origins. CVE-2026-87570 undermines that boundary through an authorization check that does not correctly enforce cross-site restrictions when a specially crafted file is processed. Exploitation is not fully remote in isolation. The attacker must first compromise the renderer process, typically by chaining a separate memory-safety or logic bug, and then convince the user to open a crafted file. The combination of user interaction and prior renderer compromise makes this bug well-suited for use as a second-stage escape in a browser exploit chain. Google classifies the Chromium security severity as Medium, while the NVD scoring reflects the higher end-user impact of a successful chain.

Root Cause

The defect is an incorrect authorization check inside the Site Isolation logic. The code path that handles the crafted file input fails to correctly validate the site or origin authorization state before granting access. As a result, a compromised renderer can request resources or navigate contexts that Site Isolation should have blocked, effectively bypassing the process-level separation between sites.

Attack Vector

Exploitation proceeds in three stages. The attacker first compromises the Chrome renderer process through a separate vulnerability. The attacker then delivers a crafted file to the victim, typically via a malicious website, email attachment, or messaging platform. Finally, social engineering persuades the user to open or interact with the file inside Chrome, triggering the flawed authorization path and bypassing Site Isolation.

No verified public proof-of-concept is available. Refer to the Chromium Issue Tracker #517215407 and the Chrome Releases Update for the vendor's technical description once access restrictions are lifted.

Detection Methods for CVE-2026-87570

Indicators of Compromise

Chrome renderer processes spawning unexpected child processes or writing to unusual file paths after opening user-supplied files.
Browser telemetry showing cross-origin resource access that contradicts the loaded top-level site.
Delivery of unusual file types via phishing or drive-by download immediately followed by user file-open activity in Chrome.

Detection Strategies

Inventory Chrome versions across the fleet and flag any endpoint running a build older than 153.0.8010.36.
Correlate browser process telemetry with file-open events to identify social-engineering-driven exploit chains.
Hunt for renderer process anomalies such as unexpected sandbox escapes, unusual IPC patterns, or crashes preceding file-open events.

Monitoring Recommendations

Ingest Chrome update and version data into the SIEM to continuously track patch compliance.
Monitor email and web gateways for crafted file deliveries targeting browser users.
Alert on user education failures such as repeated opens of untrusted attachments from external senders.

How to Mitigate CVE-2026-87570

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all Windows, macOS, and Linux endpoints.
Restart Chrome after the update to ensure the patched Site Isolation code is loaded.
Audit Chromium-based browsers and embedded WebViews for equivalent fixes from their upstream vendors.
Reinforce user awareness training focused on not opening unsolicited files delivered through the browser.

Patch Information

Google addressed CVE-2026-87570 in the Chrome Stable channel build 153.0.8010.36. Details are available in the Chrome Releases Update. The underlying issue is tracked in Chromium Issue Tracker #517215407.

Workarounds

Enforce automatic Chrome updates through enterprise policy so patched builds roll out without user action.
Restrict downloads of high-risk file types at the email gateway and web proxy until patching completes.
Use application allowlisting or browser policies to prevent Chrome from opening file types not required for business use.

bash

# Verify installed Chrome version on Linux/macOS endpoints
google-chrome --version

# Windows: query the installed version via registry
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Enterprise policy snippet (Windows Group Policy / chrome.admx)
# Force automatic updates and minimum version enforcement
Software\Policies\Google\Update\UpdateDefault = 1
Software\Policies\Google\Chrome\TargetVersionPrefix = "153.0.8010.36"