CVE-2026-87573: Google Chrome Auth Bypass Vulnerability

CVE-2026-87573 Overview

CVE-2026-87573 is an improper input validation vulnerability [CWE-20] in the Network component of Google Chrome. The flaw exists in Chrome versions prior to 153.0.8010.36 and allows a remote attacker to bypass the web origin policy through a crafted HTML page. Google's Chromium security team rated the issue as Medium severity. Successful exploitation requires user interaction, such as visiting an attacker-controlled webpage. The vulnerability affects the same-origin boundary enforced by the browser's networking stack, which is a core control preventing cross-origin data access.

Critical Impact
A remote attacker can bypass Chrome's web origin policy by luring a user to a crafted HTML page, potentially exposing cross-origin resources that should be isolated by the browser.

Affected Products

Google Chrome desktop versions prior to 153.0.8010.36
Chromium-based browsers incorporating the vulnerable Network component
Downstream distributions bundling pre-patch Chrome builds

Discovery Timeline

2026-09-09 - CVE-2026-87573 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87573

Vulnerability Analysis

The vulnerability resides in Chrome's Network component, which enforces the web origin policy across HTTP requests and responses. Improper input validation in this component allows a crafted HTML page to circumvent origin checks. The web origin policy is the boundary that isolates content loaded from different scheme, host, or port combinations. Bypassing this control undermines the browser's confidentiality guarantees for cross-origin data.

Exploitation requires the victim to load attacker-controlled HTML in Chrome. The confidentiality impact is limited to information that would otherwise be protected by origin isolation, and there is no direct integrity or availability impact according to the CVSS vector. Google has not disclosed evidence of exploitation in the wild, and no public proof-of-concept has been released.

Root Cause

The root cause is improper input validation [CWE-20] within Chrome's Network stack. Malformed or unexpected input in a network-facing code path allows attacker-controlled content to reach logic that should enforce origin restrictions. The specific validation gap has not been publicly detailed by Google in line with Chromium's practice of restricting issue tracker access until users have received the patch.

Attack Vector

The attack is remote and requires user interaction. An attacker hosts a crafted HTML page and induces the victim to visit it through phishing, malvertising, or a compromised website. Once loaded, the page issues requests that exploit the validation flaw to bypass web origin policy checks and read data from a different origin. No authentication or elevated privileges are required on the target system.

No verified exploit code is available. See the Chromium Issue Tracker #513438970 for technical details once access restrictions are lifted.

Detection Methods for CVE-2026-87573

Indicators of Compromise

Chrome browser processes on endpoints reporting a version string below 153.0.8010.36
Outbound requests to unfamiliar domains hosting HTML pages that trigger unexpected cross-origin fetches
Browser telemetry showing repeated cross-origin network requests originating from a single tab or document

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build below 153.0.8010.36
Correlate web proxy logs with endpoint browser telemetry to identify sessions loading suspicious HTML followed by anomalous cross-origin activity
Monitor for phishing and malvertising campaigns delivering links to newly registered or low-reputation domains that serve HTML payloads

Monitoring Recommendations

Ingest browser version and process telemetry into a centralized data lake to enforce patch compliance reporting
Alert on Chrome installations that fail to update within the organization's patch service-level window
Track user reports of unexpected browser behavior, such as content appearing from unrelated sites, and route them to the security operations team

How to Mitigate CVE-2026-87573

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all desktop endpoints
Restart Chrome on user endpoints to ensure the patched binary is loaded into memory
Verify enterprise Chrome update policies are enforcing automatic updates and not blocking the current Stable channel

Patch Information

Google released the fix in the Chrome Stable channel update documented in the Google Chrome Desktop Update advisory. Administrators managing Chrome through group policy or a mobile device management platform should confirm that the 153.0.8010.36 build has propagated to all managed devices. Chromium-based browsers should be updated once their upstream vendors release builds incorporating the fix.

Workarounds

Restrict browsing to trusted sites through enterprise web filtering until the patch is deployed
Enable enhanced Safe Browsing in Chrome to increase the likelihood of blocking crafted attacker pages
Deliver targeted user awareness on phishing links, since exploitation requires user interaction with a crafted HTML page

bash

# Verify installed Chrome version on Linux and macOS endpoints
google-chrome --version
# Expected output should be 153.0.8010.36 or later

# On Windows, query the installed version via PowerShell
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion