CVE-2026-87584: Google Chrome WebUI Auth Bypass Vulnerability

CVE-2026-87584 Overview

CVE-2026-87584 is an incorrect authorization vulnerability [CWE-863] in the WebUI component of Google Chrome. Versions prior to 153.0.8010.36 fail to properly enforce access restrictions on privileged pages. A remote attacker can bypass system access restrictions by serving a crafted HTML page to a victim browser. Google classified the Chromium security severity as Medium.

Successful exploitation grants unauthorized access to privileged WebUI pages that should be reachable only through trusted browser flows. This expands the attack surface for follow-on browser compromise and cross-origin abuse.

Critical Impact
A crafted HTML page can bypass WebUI authorization checks and reach privileged Chrome pages remotely, without user interaction beyond visiting attacker-controlled content.

Affected Products

Google Chrome desktop versions prior to 153.0.8010.36
Chromium-based browsers that inherit the vulnerable WebUI authorization code
Chrome Stable channel across supported desktop platforms

Discovery Timeline

2026-09-09 - CVE CVE-2026-87584 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87584

Vulnerability Analysis

The vulnerability resides in Chrome's WebUI subsystem, which renders internal browser pages such as settings and diagnostic interfaces. These pages typically carry elevated privileges relative to normal web content. Incorrect authorization logic allows a remote page to reach a privileged WebUI context that should be restricted.

An attacker hosts a crafted HTML page and lures a target user to open it. The page leverages the missing or incorrect authorization check to cross the boundary between web content and privileged browser UI. The remote attack vector requires no local access to the victim system.

Bypassing WebUI authorization erodes a core browser trust boundary. It can serve as a primitive for chaining with other Chrome vulnerabilities to achieve broader impact against user data and browser integrity.

Root Cause

The root cause is an authorization defect [CWE-863] in the WebUI page-loading path. Chrome does not correctly validate whether the calling context is permitted to access a privileged WebUI target. As a result, a check that should block cross-origin navigation into privileged pages fails to enforce the restriction.

Attack Vector

The attack vector is remote and network-based. An attacker delivers a crafted HTML page through any channel that renders in Chrome, including malicious sites, ads, iframes, or link-based phishing. When the victim loads the page, the browser processes markup that triggers the authorization bypass and reaches a privileged WebUI page.

See the Chromium Issue Tracker Entry and the Google Chrome Stable Update for vendor-provided technical context.

Detection Methods for CVE-2026-87584

Indicators of Compromise

Browser telemetry showing navigation from untrusted origins to chrome:// or other privileged WebUI URLs.
HTTP proxy or web gateway logs recording HTML responses that reference privileged WebUI schemes in links, iframes, or scripts.
Endpoint records of Chrome processes running versions earlier than 153.0.8010.36 after the patch release.

Detection Strategies

Inventory installed Chrome and Chromium-derived browser versions across the fleet and flag any build below 153.0.8010.36.
Inspect web content telemetry for pages attempting navigation, redirection, or embedding of privileged browser URIs.
Correlate browser crash reports and renderer anomalies with visits to unfamiliar external domains.

Monitoring Recommendations

Track Chrome version compliance through endpoint management tooling and alert on drift from the patched build.
Monitor egress web traffic for repeated interaction patterns consistent with WebUI probing.
Review browser extension and update logs to confirm automatic update delivery reached end users.

How to Mitigate CVE-2026-87584

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all desktop endpoints.
Restart Chrome after update installation to ensure the patched binary is active in memory.
Audit Chromium-based browsers such as Edge, Brave, and Opera and apply vendor updates that incorporate the upstream fix.

Patch Information

Google released the fix in the Chrome Stable channel at version 153.0.8010.36. Refer to the Google Chrome Stable Update advisory for release details and the Chromium Issue Tracker Entry for the upstream bug reference.

Workarounds

Enforce enterprise policies that block navigation to untrusted external sites in high-risk user groups until patching completes.
Restrict Chrome usage on unpatched hosts and route users through a hardened, updated browser build.
Increase user awareness of phishing links, since exploitation begins with a victim loading a crafted HTML page.

bash

# Verify Chrome version on Linux/macOS endpoints
google-chrome --version

# Windows PowerShell version check
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# Expected output: 153.0.8010.36 or later