CVE-2026-87603: Google Chrome FileSystem Auth Bypass Flaw

CVE-2026-87603 Overview

CVE-2026-87603 is a missing authorization vulnerability [CWE-862] in the FileSystem component of Google Chrome. Versions prior to 153.0.8010.36 fail to enforce system access restrictions when processing content from crafted HTML pages. A remote attacker can exploit this weakness to bypass authorization controls on file system operations. Chromium rates the security severity as Medium.

Exploitation requires a target user to load attacker-controlled web content in a vulnerable Chrome build. No user interaction beyond visiting the page is documented as required to trigger the authorization bypass.

Critical Impact
A remote attacker can bypass FileSystem access restrictions in Chrome through a crafted HTML page, potentially exposing local file system resources to untrusted web origins.

Affected Products

Google Chrome desktop versions prior to 153.0.8010.36
Chromium-based browsers incorporating the affected FileSystem code
Stable channel builds released before the September 2026 desktop update

Discovery Timeline

2026-09-09 - CVE-2026-87603 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87603

Vulnerability Analysis

The vulnerability resides in the Chrome FileSystem implementation, which mediates web content access to file system resources. The affected code path omits an authorization check before granting access. As a result, a crafted HTML page can trigger FileSystem operations that should be blocked by Chrome's origin and permission model.

The issue is classified as a missing authorization weakness under [CWE-862]. Chromium assigned the flaw a Medium security severity in its internal triage. Google fixed the defect in the Stable channel release documented in the Google Chrome Stable Update announcement.

Root Cause

The root cause is an absent or incorrectly ordered authorization check within the FileSystem component. Chrome normally validates that a requesting origin holds the appropriate grant before serving file system APIs. In the vulnerable code path, this validation is skipped, allowing untrusted web content to reach protected operations.

Additional implementation details are tracked in the restricted Chromium Issue Tracker #501627201 entry.

Attack Vector

An attacker hosts a crafted HTML page and induces a victim running a vulnerable Chrome build to visit it. When the page loads, it invokes FileSystem functionality that reaches the unauthorized code path. The browser processes the request without enforcing the missing check, bypassing the intended access restriction.

Because the attack is delivered through standard web navigation, common vectors include phishing links, malicious advertisements, and compromised legitimate sites. No verified proof-of-concept exploit or in-the-wild exploitation has been published for this CVE.

Detection Methods for CVE-2026-87603

Indicators of Compromise

Chrome browser processes on endpoints reporting a version string below 153.0.8010.36
Unexpected file read or write events initiated by chrome.exe or the renderer process shortly after web navigation
Outbound connections from browser processes to newly registered or low-reputation domains preceding suspicious file activity

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build below 153.0.8010.36
Correlate browser navigation telemetry with subsequent local file system access to identify anomalous read patterns tied to a single tab or origin
Monitor for renderer process behaviors that deviate from typical browsing sessions, including access to user profile directories or sensitive document paths

Monitoring Recommendations

Enable EDR telemetry on browser child processes and forward file access events to a central analytics tier
Track Chrome update compliance through management tooling and alert on hosts that miss the Stable channel update
Baseline normal FileSystem API usage in enterprise web applications to make unauthorized access attempts easier to spot

How to Mitigate CVE-2026-87603

Immediate Actions Required

Update Google Chrome on all endpoints to version 153.0.8010.36 or later
Restart Chrome after the update to ensure the patched binaries are loaded
Verify Chromium-based browsers in the environment have absorbed the upstream fix before considering the exposure closed

Patch Information

Google addressed CVE-2026-87603 in the Chrome Stable channel release announced in the Google Chrome Stable Update. The fixed version is 153.0.8010.36. Enterprises using managed Chrome deployments should push the update through their standard software distribution channels and confirm rollout with version reporting.

Workarounds

Restrict browsing on unpatched hosts to trusted internal sites until the update is applied
Use group policy to disable or limit FileSystem-related web APIs where the workflow allows
Apply web filtering and DNS controls to reduce user exposure to unknown or low-reputation domains hosting crafted HTML

bash

# Verify installed Chrome version on Windows
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Verify installed Chrome version on Linux
google-chrome --version

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version