CVE-2026-87591: Google Chrome Extensions Auth Bypass Flaw

CVE-2026-87591 Overview

CVE-2026-87591 is an incorrect authorization vulnerability [CWE-863] in the Extensions component of Google Chrome. Versions of Chrome prior to 153.0.8010.36 fail to enforce system access restrictions when handling extension operations. A remote attacker can bypass these restrictions by convincing a user to install a crafted Chrome extension. Chromium classifies the security severity as Medium.

The flaw affects the browser's extension permission model, which governs what resources and APIs an installed extension may reach. Successful exploitation lets an attacker perform actions the extension should not be authorized to perform.

Critical Impact
A crafted Chrome extension can bypass system access restrictions, granting an attacker access to browser resources or host system functionality outside the extension's authorized scope.

Affected Products

Google Chrome Desktop versions prior to 153.0.8010.36
Chromium-based browsers incorporating the vulnerable Extensions component
All operating systems supported by the Chrome Stable channel

Discovery Timeline

2026-09-09 - CVE-2026-87591 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87591

Vulnerability Analysis

The vulnerability resides in the Extensions subsystem of Google Chrome. Chrome uses a permission and capability model to restrict what an installed extension may access on the host system and within the browser. This model relies on correct authorization checks before granting access to protected APIs and resources.

CVE-2026-87591 is an instance of incorrect authorization [CWE-863]. The affected code path does not properly validate whether an extension is permitted to perform a specific operation. A crafted extension can therefore reach system resources that fall outside its declared or granted permission set.

Because extensions run within the browser's trust boundary and have access to web content, credentials, and browser APIs, an authorization bypass in this layer expands the attack surface available to malicious extension code. Google has addressed the issue in Chrome Stable 153.0.8010.36.

Root Cause

The root cause is a missing or incorrect authorization check within the Extensions component. The permission enforcement logic does not fully validate the calling extension's authority against the target resource before granting access. Full technical detail is tracked in Chromium Issue Tracker #543938457.

Attack Vector

Exploitation requires an attacker to deliver and have a user install a crafted Chrome extension. Delivery vectors include sideloading, malicious listings, or supply-chain compromise of a legitimate extension. Once installed, the extension invokes the affected code path to bypass system access restrictions and reach otherwise protected functionality.

No verified public proof-of-concept code is available for this issue. Refer to the Google Chrome Update Announcement for vendor detail.

Detection Methods for CVE-2026-87591

Indicators of Compromise

Installation of Chrome extensions from outside the Chrome Web Store or from unverified publishers.
Extensions requesting or exercising APIs inconsistent with their declared purpose or manifest permissions.
Chrome processes performing file system, registry, or network operations that do not match normal user browsing behavior.

Detection Strategies

Inventory installed Chrome extensions across managed endpoints and compare against an allowlist.
Monitor Chrome version telemetry to identify hosts running builds earlier than 153.0.8010.36.
Alert on child processes spawned by chrome.exe that touch sensitive paths or credentials.

Monitoring Recommendations

Ingest browser and endpoint process telemetry into a centralized data lake for extension behavior analytics.
Track extension install, update, and permission-change events through enterprise browser management or Group Policy logs.
Correlate anomalous outbound network connections from browser processes with recent extension installs.

How to Mitigate CVE-2026-87591

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints.
Restart Chrome after the update so the patched binaries load into active browser sessions.
Audit installed extensions and remove any that are unnecessary, unmaintained, or from untrusted publishers.

Patch Information

Google released the fix in the Chrome Stable channel at version 153.0.8010.36. See the Google Chrome Update Announcement for release detail and the Chromium Issue Tracker #543938457 for the underlying issue reference. Chromium-based browsers should apply their vendor's corresponding update once available.

Workarounds

Enforce an extension allowlist through the ExtensionInstallAllowlist and ExtensionInstallBlocklist enterprise policies.
Disable extension sideloading and restrict installs to reviewed Chrome Web Store entries.
Apply least-privilege review to any extension that requests broad host permissions such as <all_urls>.

bash

# Example Chrome enterprise policy (Windows registry) restricting extensions
# HKLM\Software\Policies\Google\Chrome\ExtensionInstallBlocklist
#   "1" = "*"
# HKLM\Software\Policies\Google\Chrome\ExtensionInstallAllowlist
#   "1" = "<approved-extension-id>"