CVE-2026-87598 Overview
CVE-2026-87598 is an incorrect authorization vulnerability in the ServiceWorker component of Google Chrome. Versions prior to 153.0.8010.36 fail to properly enforce web origin policy when handling ServiceWorker requests. A remote attacker can bypass same-origin restrictions by luring a user to a crafted HTML page. Chromium security engineers rated the flaw as Low severity, while the National Vulnerability Database (NVD) records it as Medium. The weakness maps to [CWE-863: Incorrect Authorization]. Successful exploitation enables limited disclosure of information across origin boundaries without impacting integrity or availability.
Critical Impact
Attackers can bypass the browser's web origin policy through a malicious page, potentially exposing data that should remain isolated between web origins.
Affected Products
- Google Chrome versions prior to 153.0.8010.36 (Stable channel, Desktop)
- Chromium-based ServiceWorker implementations sharing the vulnerable code path
- Downstream browsers embedding pre-patch Chromium releases
Discovery Timeline
- 2026-09-09 - CVE-2026-87598 published to NVD
- 2026-09-09 - Last updated in NVD database
- 2026-09 - Google releases Stable channel update for Desktop addressing the issue (Chrome Release Update)
Technical Details for CVE-2026-87598
Vulnerability Analysis
The vulnerability resides in Chrome's ServiceWorker subsystem. ServiceWorkers are background scripts that intercept network requests and cache responses on behalf of a registered origin. Chrome must enforce origin isolation to ensure a worker only operates on resources tied to its own origin. In affected versions, an authorization check does not correctly validate the requesting context against the ServiceWorker's registered scope. An attacker-controlled HTML page can trigger the flawed check and interact with content that should be restricted by the same-origin policy. Impact is limited to confidentiality, with user interaction required to load the crafted page. The Chromium issue tracker entry #499218516 tracks the underlying defect.
Root Cause
The root cause is an authorization logic error [CWE-863] in the ServiceWorker request handling path. Chrome performs an insufficient check when correlating a request's origin with the ServiceWorker's controlled scope. This gap allows cross-origin operations that the browser's security model should reject.
Attack Vector
Exploitation requires a victim to visit a malicious web page. The page hosts crafted HTML and script content that registers or interacts with a ServiceWorker to elicit the flawed authorization decision. No privileges or credentials are needed on the target system. The attack executes remotely over the network within the browser sandbox.
No public proof-of-concept exploit code was released for this issue. Refer to the Chromium Issue Tracker #499218516 once it becomes publicly accessible for technical details on the fix.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-87598
Indicators of Compromise
- Chrome browser versions reporting a build string earlier than 153.0.8010.36 on managed endpoints
- Browser telemetry showing ServiceWorker registrations from newly encountered or low-reputation domains
- Web proxy logs recording repeated cross-origin fetches initiated from ServiceWorker contexts on suspicious pages
Detection Strategies
- Inventory installed Chrome versions across the fleet using endpoint management tooling and flag hosts below 153.0.8010.36.
- Correlate DNS and HTTP proxy logs to identify user visits to newly registered domains that install ServiceWorkers.
- Monitor browser extension and enterprise policy telemetry for anomalous ServiceWorker scope registrations.
Monitoring Recommendations
- Ingest Chrome enterprise reporting events into a centralized log platform for version and policy compliance tracking.
- Alert on outbound connections to domains classified as newly observed or associated with credential harvesting.
- Track user-reported browser anomalies such as unexpected redirects or content bleed across tabs.
How to Mitigate CVE-2026-87598
Immediate Actions Required
- Update Google Chrome to version 153.0.8010.36 or later on all Windows, macOS, and Linux endpoints.
- Force a browser restart through enterprise policy to complete the update after installation.
- Verify managed browser fleets through Chrome Browser Cloud Management or equivalent tooling.
Patch Information
Google addressed CVE-2026-87598 in the Stable channel update for Desktop. Administrators should reference the Chrome Release Update for full version details and roll the patch through standard change management. Endpoints must be running 153.0.8010.36 or newer to receive the fix.
Workarounds
- Restrict user browsing to trusted domains through web filtering while patch deployment is in progress.
- Disable ServiceWorker functionality via enterprise policy where compatible with business applications.
- Educate users to avoid opening unsolicited links that load unfamiliar HTML content.
# Verify installed Chrome version on Linux endpoints
google-chrome --version
# Windows: query the installed version via registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
