CVE-2026-87575: Google Chrome Auth Bypass Vulnerability

CVE-2026-87575 Overview

CVE-2026-87575 is an incorrect authorization vulnerability in the Loader component of Google Chrome prior to version 153.0.8010.36. A remote attacker can bypass system access restrictions by convincing a user to visit a crafted HTML page. The flaw is classified under [CWE-863: Incorrect Authorization] and requires user interaction to succeed. Google Chromium classifies the security severity as Low, while NVD assigns a medium score reflecting the network attack surface and social engineering requirement. Successful exploitation enables limited confidentiality and integrity impact on the affected browser instance.

Critical Impact
Attackers can bypass Chrome's system access restrictions through a malicious webpage, potentially exposing browser resources that should be gated by authorization checks.

Affected Products

Google Chrome Desktop versions prior to 153.0.8010.36
Chromium-based browsers incorporating the affected Loader component
All operating systems supported by Chrome Desktop (Windows, macOS, Linux)

Discovery Timeline

2026-09-09 - CVE-2026-87575 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87575

Vulnerability Analysis

The vulnerability resides in Chrome's Loader component, which handles resource fetching and enforces access control decisions for network and local requests. An incorrect authorization check permits requests that should be denied under Chrome's security model. An attacker hosting a crafted HTML page can trick a user into loading content that exercises the flawed authorization path. The result is a bypass of system access restrictions that would normally isolate browser contexts or resource origins. Because exploitation depends on user interaction, phishing and drive-by delivery are the practical attack channels.

Root Cause

The root cause is an improper authorization decision inside the Loader ([CWE-863]). Chrome fails to correctly validate whether a given request meets the required access policy before proceeding. This mishandling allows a crafted page to reach protected functionality that should be blocked.

Attack Vector

Exploitation occurs over the network and requires a user to visit or interact with attacker-controlled HTML content. No authentication is required on the target system. The bypass yields limited confidentiality and integrity impact, with no direct availability consequence. Refer to the Chromium Issue Tracker entry 540013886 for restricted technical details.

No public proof-of-concept code is available for this vulnerability. The Loader-level authorization bypass is described in the Google Chrome Desktop Update advisory.

Detection Methods for CVE-2026-87575

Indicators of Compromise

Chrome browser processes running versions prior to 153.0.8010.36 in the enterprise fleet
Outbound connections from browsers to newly registered or low-reputation domains hosting HTML lures
Unexpected browser child process activity following user navigation to untrusted links

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build below 153.0.8010.36
Correlate web proxy logs with threat intelligence to identify users visiting suspicious pages that could deliver crafted HTML payloads
Monitor endpoint telemetry for anomalous file access or resource loads originating from chrome.exe shortly after navigation events

Monitoring Recommendations

Enable browser telemetry forwarding to a centralized log platform for retrospective hunting
Track Chrome update compliance through management tooling such as Chrome Browser Cloud Management or MDM policies
Alert on user reports of unexpected browser prompts, downloads, or permission requests following link clicks

How to Mitigate CVE-2026-87575

Immediate Actions Required

Update Google Chrome Desktop to version 153.0.8010.36 or later on all managed endpoints
Restart Chrome after the update to ensure the patched Loader component is loaded
Reinforce user awareness against clicking unsolicited links or opening untrusted HTML attachments

Patch Information

Google released the fix in the Chrome Stable channel update documented in the Google Chrome Desktop Update advisory. Administrators should deploy version 153.0.8010.36 or newer through their standard browser management workflow.

Workarounds

Enforce automatic Chrome updates through enterprise policy to shorten exposure windows
Restrict browsing to trusted sites using web filtering or DNS-layer controls where feasible
Block execution of Chrome versions below 153.0.8010.36 through application control policies until the update is deployed

bash

# Verify installed Chrome version on Linux/macOS endpoints
google-chrome --version

# Windows: query the installed version via registry
reg query "HKLM\Software\Google\Chrome\BLBeacon" /v version