CVE-2026-87577: Google Chrome Authorization Bypass Vulnerability

CVE-2026-87577 Overview

CVE-2026-87577 is an incorrect authorization vulnerability in the Isolated component of Google Chrome. Versions prior to 153.0.8010.36 allow a remote attacker to bypass the web origin policy and reach a privileged page via a crafted HTML page. The flaw is classified under CWE-863: Incorrect Authorization and carries a Chromium security severity rating of Medium. Exploitation requires user interaction, such as visiting an attacker-controlled site, but no prior authentication. Google addressed the issue in a Stable channel update for Chrome Desktop.

Critical Impact
An attacker who lures a user to a crafted page can cross the boundary from a normal web origin into a privileged Chrome page, exposing browser-privileged surfaces to web content.

Affected Products

Google Chrome Desktop prior to 153.0.8010.36
Chromium-based builds sharing the vulnerable Isolated component
Downstream browsers packaging affected Chromium versions

Discovery Timeline

2026-09-09 - CVE-2026-87577 published to the National Vulnerability Database (NVD)
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87577

Vulnerability Analysis

The vulnerability resides in Chrome's Isolated component, which enforces separation between standard web origins and privileged browser pages. An authorization check fails to correctly distinguish requests originating from untrusted web content when a crafted HTML page is loaded. As a result, a remote attacker can bypass the same-origin and web origin policy enforcement and reach a privileged page context. Privileged pages typically expose browser-internal APIs and surfaces not intended to be reachable from arbitrary web content. Crossing that boundary weakens the security model that isolates untrusted web code from the browser's trusted UI and internal functionality.

Root Cause

The root cause is an incorrect authorization decision within the Isolated component. The check that governs which origins may transition into a privileged page context does not adequately validate the requesting origin. This maps to CWE-863: Incorrect Authorization, where an access control decision is performed but produces an incorrect result. Details are tracked in Chromium Issue Tracker #501700023.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker hosts a crafted HTML page and induces a target user to visit it, for example through phishing, malvertising, or a compromised third-party site. When the page loads in a vulnerable Chrome build, it triggers the flawed authorization path in the Isolated component to reach a privileged page. No verified public proof-of-concept or exploit is currently listed, and the vulnerability is not present on the CISA Known Exploited Vulnerabilities list. Refer to the Google Chrome Desktop Update for the vendor description.

No verified proof-of-concept code is available for this vulnerability. See the Chromium Issue Tracker #501700023 for technical tracking details.

Detection Methods for CVE-2026-87577

Indicators of Compromise

Chrome browser processes on hosts still running a version earlier than 153.0.8010.36 after the patch release date
Browser telemetry showing navigation from external web origins immediately followed by loads of Chrome-privileged page schemes such as chrome://
User reports of unexpected Chrome internal pages appearing after visiting untrusted sites

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build earlier than 153.0.8010.36
Monitor web proxy and DNS logs for user navigation to newly registered or low-reputation domains delivering HTML payloads targeting Chromium bugs
Correlate browser process telemetry with subsequent spawning of unusual child processes or extension changes following a browsing session

Monitoring Recommendations

Ingest endpoint browser version data into a central logging platform and alert on drift from the patched baseline
Track Chrome update channel status to confirm Stable channel rollouts have completed enterprise-wide
Review browser extension and privileged page activity for anomalies that could indicate abuse of the Isolated component boundary

How to Mitigate CVE-2026-87577

Immediate Actions Required

Update Google Chrome Desktop to version 153.0.8010.36 or later on all managed endpoints
Restart Chrome after updating to ensure the patched binaries are loaded into running sessions
Validate that automatic updates are enabled and functioning on end-user devices

Patch Information

Google released the fix in the Stable channel update documented at the Google Chrome Desktop Update. Administrators should confirm that Chrome reports version 153.0.8010.36 or higher under chrome://settings/help. Enterprise deployments managed through Chrome Browser Cloud Management or group policy should push the update through their existing channels. Chromium-derived browsers should be updated once their maintainers integrate the corresponding fix.

Workarounds

Restrict browsing to trusted sites through web filtering until all endpoints are patched
Disable or restrict access to non-essential Chrome privileged pages through enterprise policy where supported
Provide user awareness guidance to avoid opening unsolicited links that load crafted HTML content

bash

# Verify installed Chrome version on Linux and macOS endpoints
google-chrome --version

# Windows: query the installed version from the registry
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv