CVE-2026-87593: Google Chrome Information Disclosure Flaw

CVE-2026-87593 Overview

CVE-2026-87593 is an information disclosure vulnerability in the Editing component of Google Chrome versions prior to 153.0.8010.36. A remote attacker can obtain sensitive information by tricking a user into visiting a crafted HTML page. The Chromium project classified the underlying issue with an internal security severity of Low, while the National Vulnerability Database rates the CVE as Medium.

The flaw is categorized under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Exploitation requires user interaction but no authentication, making phishing and drive-by scenarios the likely delivery paths.

Critical Impact
A remote attacker can exfiltrate sensitive in-browser data from any user who loads a malicious page in an unpatched Chrome build.

Affected Products

Google Chrome Desktop versions prior to 153.0.8010.36
Chromium-based browsers embedding the vulnerable Editing component
Downstream browser distributions that had not yet integrated the upstream fix

Discovery Timeline

2026-09-09 - CVE-2026-87593 published to the National Vulnerability Database
2026-09-09 - Google publishes the Chrome Stable Channel update for desktop
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87593

Vulnerability Analysis

The vulnerability resides in Chrome's Editing component, which handles content-editable regions, text input, selection, and clipboard interactions within web pages. An attacker-controlled HTML document can manipulate the editing pipeline to leak data that should remain isolated within the browser process or another origin. Because the attack requires only that a victim visit a crafted page, weaponization through malvertising, compromised sites, or phishing links is straightforward.

The issue is tracked in the Chromium issue tracker entry 553252820, which remains restricted pending broad patch adoption. No public proof-of-concept exploit is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is improper handling of content within the Editing subsystem that allows sensitive information to cross a trust boundary. Editing code paths interact with the Document Object Model (DOM), clipboard APIs, and IPC surfaces where mishandled state can expose data from other frames, origins, or process memory. The Chromium security team's classification of Low severity indicates the leaked information is bounded rather than arbitrary memory disclosure.

Attack Vector

An attacker hosts a crafted HTML page and lures a victim to load it in a vulnerable Chrome build. When the page is rendered, JavaScript within the page drives the Editing component into a state that exposes sensitive data back to the attacker's script. The attacker then exfiltrates the data using standard channels such as fetch() or WebSocket beacons. No credentials are required, and the entire chain executes in the victim's browser context.

No verified exploitation code is publicly available. Refer to the Chromium issue tracker once access restrictions are lifted for the reproducer and patch details.

Detection Methods for CVE-2026-87593

Indicators of Compromise

Outbound requests from browser processes to newly registered or low-reputation domains shortly after users visit unfamiliar sites
Unusual POST requests carrying encoded payloads originating from Chrome renderer processes
User reports of unexpected content in text fields, clipboard, or editable regions after browsing

Detection Strategies

Inventory Chrome installations across the fleet and flag any version below 153.0.8010.36 as vulnerable
Correlate web proxy telemetry with endpoint browser process telemetry to identify pages that trigger anomalous data egress
Hunt for suspicious HTML files delivered via email or messaging that reference contenteditable, document.execCommand, or Selection APIs alongside outbound network calls

Monitoring Recommendations

Enable browser update compliance reporting via Chrome Browser Cloud Management or equivalent MDM tooling
Forward browser process telemetry and DNS logs to a centralized analytics platform for correlation and retention
Alert on Chrome renderer processes contacting domains not previously observed in the environment within a short window of page navigation

How to Mitigate CVE-2026-87593

Immediate Actions Required

Upgrade all Google Chrome desktop installations to version 153.0.8010.36 or later without delay
Restart Chrome after the update installs to ensure the patched binary is loaded into memory
Push the update through enterprise management tooling to remove reliance on end-user action

Patch Information

Google addressed CVE-2026-87593 in the Chrome Stable channel release announced in the Stable Channel Update for Desktop. Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi should apply the corresponding upstream merge as their vendors publish downstream releases. Verify installed versions via chrome://settings/help on endpoints or through central inventory reporting.

Workarounds

Restrict browsing to trusted sites through enterprise URL allow-lists until patching completes
Deploy Chrome enterprise policies that disable auto-loading of untrusted content and restrict clipboard read access
Increase user awareness of phishing links that deliver crafted HTML pages during the remediation window

bash

# Verify Chrome version on Windows endpoints
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Verify Chrome version on macOS endpoints
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString

# Verify Chrome version on Linux endpoints
google-chrome --version