CVE-2026-87574: Google Chrome Information Disclosure Flaw

CVE-2026-87574 Overview

CVE-2026-87574 is an information disclosure vulnerability in the ServiceWorker component of Google Chrome. The flaw allows a remote attacker to obtain cross-origin data by convincing a user to visit a crafted HTML page. Google addressed the issue in Chrome stable channel version 153.0.8010.36 for desktop. The vulnerability is classified under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor) and requires user interaction to exploit. Chromium rated the security severity as Medium.

Critical Impact
A remote attacker can bypass the same-origin policy through a crafted web page and read cross-origin data handled by ServiceWorker, undermining browser isolation guarantees.

Affected Products

Google Chrome desktop versions prior to 153.0.8010.36
Chromium-based browsers sharing the same ServiceWorker code path
All operating system builds distributed through the Chrome stable channel

Discovery Timeline

2026-09-09 - CVE-2026-87574 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database
2026-09-09 - Google published the Chrome Desktop Update Announcement

Technical Details for CVE-2026-87574

Vulnerability Analysis

The vulnerability resides in Chrome's ServiceWorker implementation. ServiceWorkers are background scripts that intercept and handle network requests for a registered origin. They mediate fetch events, cache responses, and enable offline functionality.

This flaw permits a malicious page to observe or retrieve data belonging to a different origin. Because ServiceWorkers operate at the boundary between the network layer and the rendering process, any leak through this interface breaks the same-origin policy that browsers rely on for web isolation.

The issue is categorized as an Information Disclosure ([CWE-200]) rather than a memory corruption bug. Exploitation does not grant code execution but exposes data that should remain confidential between origins, such as response bodies or metadata associated with authenticated sessions on unrelated sites.

Root Cause

According to Google's advisory, the ServiceWorker component fails to enforce cross-origin restrictions on specific data paths. The Chromium project has not published the full technical details in the public Chromium Issue Tracker Entry at the time of publication, following standard practice of restricting access until the fix reaches most users.

Attack Vector

Exploitation requires an attacker to host a crafted HTML page and lure a target user to visit it. Once the page loads in an unpatched Chrome instance, the attacker's script leverages ServiceWorker behavior to observe cross-origin responses that should be inaccessible. No authentication or elevated privileges are required on the victim's browser, but user interaction is necessary.

Since no verified proof-of-concept has been published, technical exploitation code is not reproduced here. Refer to the Chromium issue tracker for details as they become public.

Detection Methods for CVE-2026-87574

Indicators of Compromise

Chrome browser telemetry reporting a version string earlier than 153.0.8010.36 on managed endpoints
Outbound connections from browser processes to newly registered or low-reputation domains hosting unusual ServiceWorker registrations
Web proxy logs showing unexpected Service-Worker: script request headers to third-party origins

Detection Strategies

Inventory Chrome installations across the fleet and flag any host running a build below 153.0.8010.36
Correlate browser process activity with web content categorization to identify visits to attacker-controlled pages
Use browser management policies to log ServiceWorker registrations for review by the security operations team

Monitoring Recommendations

Track Chrome auto-update status through endpoint management tooling to confirm patch adoption
Alert on user reports of unexpected authenticated session behavior on frequently used web applications
Monitor DNS and HTTP proxy telemetry for traffic to domains flagged in threat intelligence feeds serving malicious ServiceWorkers

How to Mitigate CVE-2026-87574

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all desktop platforms
Verify auto-update is enabled and functioning by inspecting the chrome://settings/help page on representative hosts
Push the update through enterprise management tools such as Google Chrome Enterprise, Microsoft Intune, or Jamf to accelerate rollout

Patch Information

Google released the fix in the Chrome stable channel on 2026-09-09. Details are available in the Chrome Desktop Update Announcement. Chromium-based browsers such as Microsoft Edge, Brave, and Opera should apply their respective vendor patches once merged from the upstream Chromium fix.

Workarounds

Restrict browsing to trusted sites via web content filtering until the patch is deployed across the environment
Disable ServiceWorker functionality for high-risk user groups through enterprise browser policies where operationally acceptable
Educate users to avoid clicking untrusted links, since exploitation requires visiting a crafted page

bash

# Verify Chrome version on Linux endpoints
google-chrome --version

# Force update check across managed Windows endpoints via GoogleUpdate
"%ProgramFiles(x86)%\Google\Update\GoogleUpdate.exe" /ua /installsource scheduler