CVE-2026-87580: Google Chrome Authorization Bypass Vulnerability

CVE-2026-87580 Overview

CVE-2026-87580 is an incorrect authorization vulnerability [CWE-863] in the WebAppInstalls component of Google Chrome. The flaw affects Chrome versions prior to 153.0.8010.36. A remote attacker who has already compromised the renderer process can bypass site isolation by combining the flaw with social engineering delivered through a crafted HTML page. Chromium rates the security severity as Medium.

Critical Impact
Successful exploitation allows an attacker with renderer-level compromise to bypass Chrome's site isolation boundary, breaking a core browser security guarantee that separates content from different origins.

Affected Products

Google Chrome versions prior to 153.0.8010.36 on desktop
Chromium-based browsers sharing the affected WebAppInstalls code path
Any deployment running an unpatched Chrome Stable channel build

Discovery Timeline

2026-09-09 - CVE-2026-87580 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87580

Vulnerability Analysis

The vulnerability resides in the WebAppInstalls feature, which handles installation of Progressive Web Apps (PWAs) and related web application flows in Chrome. Chrome enforces site isolation by placing content from different sites into separate renderer processes. This boundary prevents a compromised renderer from accessing data owned by another origin.

The WebAppInstalls code path performs an authorization check that does not correctly validate the site context of the requesting renderer. An attacker who has already achieved code execution inside a renderer process can invoke the install flow in a way that treats the request as authorized for a different origin. Social engineering is required to prompt the victim into an install-related interaction that completes the bypass.

Root Cause

The root cause is an incorrect authorization check [CWE-863] within the WebAppInstalls component. The browser process trusts a claim originating from a renderer without adequately verifying that the renderer is authorized to act on behalf of the target site. This weakens the site isolation boundary that normally contains renderer compromises.

Attack Vector

Exploitation requires two preconditions. First, the attacker must already have compromised a renderer process, typically through a separate memory corruption or logic flaw. Second, the attacker must persuade the user to interact with a crafted HTML page that triggers a WebAppInstalls flow. The combination allows the compromised renderer to reach across the site isolation boundary. The vulnerability is not directly exploitable through a drive-by page load alone.

No public proof-of-concept code is available. The Chromium issue tracker entry 502986244 is restricted at the time of publication. Refer to the Chromium Issue Tracker #502986244 and the Google Chrome Stable Update for vendor details.

Detection Methods for CVE-2026-87580

Indicators of Compromise

Unexpected PWA install prompts or completed web app installations originating from unfamiliar domains.
Chrome renderer processes spawning or persisting unusual child processes following user interaction with an untrusted page.
New entries in the Chrome web app installation directory that do not correspond to user-approved sites.

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any endpoint running a build earlier than 153.0.8010.36.
Correlate browser telemetry with process creation events to identify renderer processes performing cross-origin actions inconsistent with the loaded site.
Hunt for HTML content that programmatically invokes beforeinstallprompt handlers followed by unexpected navigation or install completion events.

Monitoring Recommendations

Ingest Chrome enterprise reporting events into a central data lake to track install activity and version drift.
Alert on execution of newly installed PWAs from non-approved origins on managed endpoints.
Monitor for exploit chains that pair a renderer-level vulnerability with WebAppInstalls API activity in the same session.

How to Mitigate CVE-2026-87580

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints.
Restart Chrome after the update to ensure the patched binaries are loaded into active sessions.
Prioritize patching for users who install PWAs or interact frequently with untrusted web content.

Patch Information

Google addressed the flaw in the Chrome Stable channel release documented in the Google Chrome Stable Update advisory. Patched versions are 153.0.8010.36 and later. Chromium-derived browsers should pick up the fix once they rebase onto the corresponding upstream revision.

Workarounds

Disable web app installation through the WebAppInstallForceList and DefaultWebAppInstallForce enterprise policies where PWAs are not required.
Restrict which origins can trigger install prompts using the WebAppSettings policy to reduce social engineering exposure.
Enforce automatic Chrome updates through group policy or mobile device management to close the window of exposure.

bash

# Configuration example: enforce Chrome auto-update and disable PWA installs via policy (Linux JSON policy)
# /etc/opt/chrome/policies/managed/cve-2026-87580.json
{
  "DefaultWebAppInstallForce": 0,
  "WebAppInstallForceList": [],
  "ComponentUpdatesEnabled": true,
  "RelaunchNotification": 2,
  "RelaunchNotificationPeriod": 86400000
}