CVE-2026-87571: Google Chrome Auth Bypass Vulnerability

CVE-2026-87571 Overview

CVE-2026-87571 is an improper certificate validation vulnerability [CWE-295] in the Loader component of Google Chrome versions prior to 153.0.8010.36. A remote attacker who successfully lures a user into interacting with crafted network traffic can bypass web origin policy. The flaw affects the browser's handling of certificates during resource loading. Google classifies the Chromium security severity as Low, while the CVSS base score of 5.4 reflects the requirement for user interaction and the limited scope of confidentiality and integrity impact. No known exploitation in the wild has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Critical Impact
Attackers can bypass same-origin protections by leveraging invalid certificate handling in the Loader, enabling cross-origin data access when combined with social engineering.

Affected Products

Google Chrome versions prior to 153.0.8010.36 (Desktop Stable channel)
Chromium-based browsers that inherit the vulnerable Loader code
All operating system platforms supported by Chrome Desktop

Discovery Timeline

2026-09-09 - CVE CVE-2026-87571 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87571

Vulnerability Analysis

The vulnerability resides in the Chrome Loader, the subsystem responsible for fetching subresources and enforcing web platform security boundaries. The Loader performs insufficient validation of certificates presented during resource retrieval. Attackers can exploit this weakness to bypass the web origin policy, one of the browser's core isolation mechanisms.

Bypassing the origin policy allows a malicious origin to interact with data or resources it should not be able to reach. The attack requires the victim to visit or engage with a crafted page, so successful exploitation depends on social engineering.

Root Cause

The root cause is improper certificate validation [CWE-295] within the resource loading pipeline. The Loader accepts or processes certificates without enforcing the checks required to preserve origin boundaries. As a result, network responses that should be treated as untrusted or cross-origin are handled as if they were properly authenticated, weakening the same-origin model.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker hosts a malicious page or intercepts network traffic against a targeted user. When the victim visits the page or interacts with the crafted content, the Loader mishandles certificate validation during subsequent requests. The attacker then reads or influences data across origin boundaries that should remain isolated.

No public proof-of-concept has been published, and no exploit code is currently available in ExploitDB or other tracked repositories.

Detection Methods for CVE-2026-87571

Indicators of Compromise

Chrome browser processes running versions earlier than 153.0.8010.36 in enterprise inventories
Outbound TLS connections presenting anomalous or malformed certificates from user endpoints
Unexpected cross-origin resource loads in browser telemetry or web proxy logs

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag builds below 153.0.8010.36
Inspect TLS interception logs and web proxy telemetry for certificate anomalies during user browsing sessions
Correlate visits to newly registered or low-reputation domains with subsequent unusual cross-origin activity

Monitoring Recommendations

Enable browser version reporting through enterprise management policies to detect out-of-date clients
Monitor endpoint EDR telemetry for Chrome renderer processes making unexpected network requests
Ingest browser and proxy logs into a centralized analytics platform to baseline normal origin interactions and alert on deviations

How to Mitigate CVE-2026-87571

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints
Enforce automatic updates through group policy or MDM to prevent version drift
Communicate phishing and social engineering awareness reminders to users, since exploitation requires user interaction

Patch Information

Google addressed the vulnerability in the Chrome Stable channel release 153.0.8010.36. Refer to the Google Chrome Stable Update advisory and the Chromium Issue #540046516 for release details. Chromium-derived browsers should apply the corresponding upstream fix.

Workarounds

Restrict user browsing to trusted sites via web filtering while patching is in progress
Disable or restrict access to untrusted networks where TLS interception risks are elevated
Deploy browser isolation for high-risk user populations until the update is fully rolled out

bash

# Verify installed Chrome version on Linux/macOS endpoints
google-chrome --version

# Windows: check the DisplayVersion registry value for Google Chrome
reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome" /v DisplayVersion