CVE-2026-87605 Overview
CVE-2026-87605 is a missing authorization vulnerability [CWE-862] in the Contacts component of Google Chrome versions prior to 153.0.8010.36. A remote attacker who has already compromised the renderer process can leverage social engineering through a crafted HTML page to potentially obtain sensitive information. Chromium's security team rated the underlying issue as Low severity, while the National Vulnerability Database (NVD) assigns a medium score reflecting the high confidentiality impact under specific preconditions.
Critical Impact
Successful exploitation can expose contact data from the browser to a remote attacker, but requires prior renderer compromise and user interaction, limiting practical exploitability.
Affected Products
- Google Chrome versions prior to 153.0.8010.36
- Chromium-based browsers sharing the vulnerable Contacts component
- Desktop Stable Channel builds of Google Chrome
Discovery Timeline
- 2026-09-09 - CVE-2026-87605 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-87605
Vulnerability Analysis
The vulnerability resides in the Contacts feature of Google Chrome. Chrome's Contacts API allows web applications to request user contact information through a browser-mediated picker. The flaw stems from a missing authorization check that should validate whether a caller is permitted to invoke the associated functionality.
Because the check is absent, an attacker who has already gained code execution inside the renderer process can attempt to invoke Contacts-related operations that should be gated. Combined with a social engineering step delivered through a crafted HTML page, the attacker can trick the user into producing sensitive contact information that is then exfiltrated.
Exploitation requires two preconditions. First, the attacker must compromise the renderer process, typically through a separate memory corruption or logic bug. Second, the attacker must convince the user to interact with a crafted page in a specific way. These preconditions raise attack complexity substantially.
Root Cause
The root cause is a missing authorization enforcement path [CWE-862] in the Contacts component. The code performs a sensitive action without first verifying that the caller holds appropriate permissions. See Chromium Issue #533084499 for developer discussion.
Attack Vector
The attack vector is network-based and requires user interaction. The attacker delivers a crafted HTML page to a user whose browser renderer is already under attacker control. The user is then manipulated through social engineering into performing an action that surfaces contact data to the attacker-controlled context.
No public proof-of-concept exploit has been published for CVE-2026-87605. Technical details are available in the Chrome Stable Channel Update advisory.
Detection Methods for CVE-2026-87605
Indicators of Compromise
- Chrome browser processes running versions earlier than 153.0.8010.36 in enterprise inventories
- Unexpected outbound HTTP requests from browser processes carrying structured contact fields such as names, emails, or phone numbers
- Renderer process anomalies preceding unusual UI prompts related to Contacts selection
Detection Strategies
- Inventory installed Chrome versions across managed endpoints and flag any build below 153.0.8010.36
- Monitor for renderer process exploitation indicators, since this vulnerability requires a prior renderer compromise to be actionable
- Correlate suspicious phishing-style page loads with browser telemetry showing Contacts API invocations
Monitoring Recommendations
- Ingest browser process telemetry into a centralized security data lake for version and behavior analysis
- Alert on Chrome child processes making non-standard network connections shortly after user interaction with untrusted sites
- Track Chromium security advisories through the Chrome Releases blog to identify newly disclosed component flaws
How to Mitigate CVE-2026-87605
Immediate Actions Required
- Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints
- Restart the browser after update to ensure the patched binaries are loaded
- Verify auto-update policies are enabled and functioning across the fleet
Patch Information
Google addressed CVE-2026-87605 in Chrome 153.0.8010.36 on the Stable Channel for Desktop. Administrators should reference the Chrome Stable Channel Update for full release notes and deploy the update through their standard patch management workflow.
Workarounds
- Enforce enterprise policies that block or restrict use of the Contacts Picker API where not required
- Deploy phishing-resistant user awareness training to reduce the social engineering component required for exploitation
- Apply strict browser isolation or site isolation policies for high-risk user groups until patching completes
# Verify Chrome version on Linux/macOS endpoints
google-chrome --version
# Windows PowerShell version check
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
