CVE-2026-87589 Overview
CVE-2026-87589 is an incorrect authorization vulnerability [CWE-863] in the Site Isolation component of Google Chrome. The flaw affects Chrome versions prior to 153.0.8010.36. A remote attacker who has already compromised the renderer process can bypass system access restrictions by serving a crafted HTML page. Google classifies the Chromium security severity as Medium. Exploitation requires user interaction, such as visiting a malicious web page, and a prior renderer compromise chained with this bypass.
Critical Impact
An attacker with a compromised renderer can bypass Site Isolation boundaries and access resources that should be restricted, undermining Chrome's core sandbox segmentation model.
Affected Products
- Google Chrome versions prior to 153.0.8010.36 (Stable channel, Desktop)
- Chromium-based components relying on Site Isolation enforcement
- Downstream Chromium browsers that have not merged the fix
Discovery Timeline
- 2026-09-09 - CVE-2026-87589 published to the National Vulnerability Database (NVD)
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-87589
Vulnerability Analysis
Site Isolation is Chrome's security architecture that places pages from different sites into separate renderer processes. It enforces cross-origin boundaries even if a renderer is compromised. CVE-2026-87589 breaks that guarantee. The Site Isolation logic performs an incorrect authorization check when validating renderer requests. An attacker who already controls a renderer can craft an HTML page that induces the browser to grant access it should deny. The result is a partial escape from the segmentation model that Chrome relies on to protect cross-site data.
The issue is scoped to integrity impact. Confidentiality and availability are not directly affected according to the published CVSS vector. Exploitation is not straightforward because it requires a working renderer compromise as a prerequisite. When chained with a renderer exploit, however, the bypass gives an attacker a wider reach into resources gated by Site Isolation.
Root Cause
The root cause is an authorization defect [CWE-863] in Site Isolation. Access decisions do not correctly verify that the requesting renderer holds the required privileges for the target resource. Missing or flawed policy checks allow a malicious renderer to submit requests that the browser process approves in error.
Attack Vector
The attack is network-based and requires user interaction. A victim must load an attacker-controlled or attacker-influenced page in a vulnerable Chrome build. The attacker must also already control the renderer process, typically through a separate renderer exploit. The crafted HTML then triggers the incorrect authorization path to bypass system access restrictions.
// No verified public proof-of-concept is available for CVE-2026-87589.
// See the Chromium tracker for technical details once access is granted:
// https://issues.chromium.org/issues/518002426
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-87589
Indicators of Compromise
- Chrome renderer processes making unexpected inter-process requests to browser-process endpoints associated with site data access.
- Browser telemetry showing Site Isolation policy violations or unusual cross-site resource fetches from a single renderer.
- Outbound connections from user endpoints to newly registered domains hosting exploit-style HTML payloads.
Detection Strategies
- Inventory installed Chrome versions across managed endpoints and flag any build below 153.0.8010.36.
- Correlate browser crash reports and renderer termination events with visits to untrusted domains.
- Monitor for post-compromise behavior on endpoints running vulnerable Chrome, including unexpected child processes or credential access attempts.
Monitoring Recommendations
- Ingest Chrome update and version telemetry into the SIEM to track patch compliance over time.
- Alert on endpoints that remain on pre-153.0.8010.36 builds beyond a defined patch window.
- Baseline normal browser process behavior and alert on deviations such as anomalous file system, registry, or network activity originating from Chrome child processes.
How to Mitigate CVE-2026-87589
Immediate Actions Required
- Update Google Chrome to version 153.0.8010.36 or later on all Windows, macOS, and Linux endpoints.
- Force a browser restart after update deployment to ensure the patched binaries load.
- Verify downstream Chromium-based browsers have merged the corresponding fix before considering them safe.
Patch Information
Google released the fix in the Chrome Stable channel update announced in the Google Chrome Stable Update. The Chromium tracking entry is Chromium Issue #518002426. Administrators should deploy 153.0.8010.36 or later through enterprise update mechanisms such as Chrome Browser Cloud Management, Group Policy, or MDM.
Workarounds
- No vendor-supplied workaround exists. Patching is the supported remediation.
- Restrict browsing on unpatched systems to trusted internal sites until the update is applied.
- Enforce least-privilege user accounts to limit the blast radius of any successful browser exploit chain.
# Verify installed Chrome version on Linux/macOS
google-chrome --version
# Expected output should be 153.0.8010.36 or later
# Windows: query installed version via registry
reg query "HKLM\Software\Google\Chrome\BLBeacon" /v version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
