CVE-2026-87590: Google Chrome Information Disclosure Flaw

CVE-2026-87590 Overview

CVE-2026-87590 is an improper input validation vulnerability [CWE-20] in the Passwords component of Google Chrome. Versions prior to 153.0.8010.36 are affected. A remote attacker can potentially leak sensitive information by delivering crafted network traffic to a targeted browser instance. Google's Chromium project rated the underlying issue as Medium severity. The flaw does not require local access and can be triggered through content served over a network path. Successful exploitation targets data handled by Chrome's password management surface.

Critical Impact
Remote attackers can potentially leak sensitive information handled by Chrome's Passwords component through crafted network traffic.

Affected Products

Google Chrome Desktop versions prior to 153.0.8010.36
Chromium-based builds incorporating the vulnerable Passwords component
Stable channel Chrome installations on supported desktop platforms

Discovery Timeline

2026-09-09 - CVE-2026-87590 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87590

Vulnerability Analysis

The vulnerability resides in the Passwords subsystem of Google Chrome. According to the vendor advisory, improper input validation allows a remote attacker to leak sensitive information via crafted network traffic. The Passwords component manages storage, autofill, and synchronization of saved credentials. Insufficient validation of untrusted input in this code path can expose data that should remain isolated from web-origin content. The issue is classified as an information disclosure weakness rather than a memory corruption or code execution flaw.

Root Cause

The root cause is improper input validation [CWE-20] within the Passwords component. Chrome accepts network-borne input without sufficient checks before it is processed by password-handling logic. This validation gap allows attacker-controlled data to influence internal state in ways that expose sensitive information. Full technical details are tracked in the Chromium Issue Tracker Entry.

Attack Vector

Exploitation occurs remotely over the network. An attacker crafts specific network traffic that Chrome processes through the vulnerable Passwords code path. No local access is required. The attacker's goal is to extract sensitive data rather than execute code. Refer to the Google Chrome Desktop Update for the vendor's release notification.

No public proof-of-concept is currently available. The EPSS probability is 0.192% at the 8.918 percentile, indicating low near-term exploitation likelihood based on public signals.

Detection Methods for CVE-2026-87590

Indicators of Compromise

No specific file hashes, network signatures, or public indicators of compromise have been published for this vulnerability.
Chrome browser instances reporting a version string below 153.0.8010.36 should be treated as vulnerable until updated.

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build older than 153.0.8010.36.
Monitor Chrome update telemetry to confirm the stable channel has rolled out the fixed build to all users.
Correlate browser process activity with unexpected outbound connections that could indicate credential exfiltration attempts.

Monitoring Recommendations

Ingest browser version and patch status into your endpoint management or SIEM to track exposure over time.
Alert on browser processes accessing password store files outside of normal autofill or sync workflows.
Track anomalous DNS and HTTPS destinations initiated by Chrome renderer or network service processes.

How to Mitigate CVE-2026-87590

Immediate Actions Required

Update Google Chrome on all desktop endpoints to version 153.0.8010.36 or later.
Force a browser restart after deployment to ensure the patched binary is loaded into memory.
Verify enterprise policies do not pin Chrome to an older, vulnerable version.

Patch Information

Google addressed the issue in the Chrome stable channel release documented in the Google Chrome Desktop Update. Administrators should deploy version 153.0.8010.36 or later through their standard software distribution tooling. Chromium-derived browsers should be updated once their maintainers ship a build incorporating the upstream fix.

Workarounds

No vendor-supplied workaround has been published; patching is the recommended remediation.
Where immediate patching is not feasible, restrict browsing to trusted sites and disable saved-password autofill on high-risk endpoints.
Consider deploying enterprise password managers separate from browser-integrated storage for privileged accounts.

bash

# Verify installed Chrome version on Linux/macOS
google-chrome --version

# Verify installed Chrome version on Windows (PowerShell)
(Get-Item "$Env:ProgramFiles\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion