CVE-2026-87605: Google Chrome Information Disclosure Flaw

CVE-2026-87605 Overview

CVE-2026-87605 is a missing authorization vulnerability [CWE-862] in the Contacts component of Google Chrome versions prior to 153.0.8010.36. A remote attacker who has already compromised the renderer process can leverage social engineering through a crafted HTML page to potentially obtain sensitive information. Chromium's security team rated the underlying issue as Low severity, while the National Vulnerability Database (NVD) assigns a medium score reflecting the high confidentiality impact under specific preconditions.

Critical Impact
Successful exploitation can expose contact data from the browser to a remote attacker, but requires prior renderer compromise and user interaction, limiting practical exploitability.

Affected Products

Google Chrome versions prior to 153.0.8010.36
Chromium-based browsers sharing the vulnerable Contacts component
Desktop Stable Channel builds of Google Chrome

Discovery Timeline

2026-09-09 - CVE-2026-87605 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87605

Vulnerability Analysis

The vulnerability resides in the Contacts feature of Google Chrome. Chrome's Contacts API allows web applications to request user contact information through a browser-mediated picker. The flaw stems from a missing authorization check that should validate whether a caller is permitted to invoke the associated functionality.

Because the check is absent, an attacker who has already gained code execution inside the renderer process can attempt to invoke Contacts-related operations that should be gated. Combined with a social engineering step delivered through a crafted HTML page, the attacker can trick the user into producing sensitive contact information that is then exfiltrated.

Exploitation requires two preconditions. First, the attacker must compromise the renderer process, typically through a separate memory corruption or logic bug. Second, the attacker must convince the user to interact with a crafted page in a specific way. These preconditions raise attack complexity substantially.

Root Cause

The root cause is a missing authorization enforcement path [CWE-862] in the Contacts component. The code performs a sensitive action without first verifying that the caller holds appropriate permissions. See Chromium Issue #533084499 for developer discussion.

Attack Vector

The attack vector is network-based and requires user interaction. The attacker delivers a crafted HTML page to a user whose browser renderer is already under attacker control. The user is then manipulated through social engineering into performing an action that surfaces contact data to the attacker-controlled context.

No public proof-of-concept exploit has been published for CVE-2026-87605. Technical details are available in the Chrome Stable Channel Update advisory.

Detection Methods for CVE-2026-87605

Indicators of Compromise

Chrome browser processes running versions earlier than 153.0.8010.36 in enterprise inventories
Unexpected outbound HTTP requests from browser processes carrying structured contact fields such as names, emails, or phone numbers
Renderer process anomalies preceding unusual UI prompts related to Contacts selection

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build below 153.0.8010.36
Monitor for renderer process exploitation indicators, since this vulnerability requires a prior renderer compromise to be actionable
Correlate suspicious phishing-style page loads with browser telemetry showing Contacts API invocations

Monitoring Recommendations

Ingest browser process telemetry into a centralized security data lake for version and behavior analysis
Alert on Chrome child processes making non-standard network connections shortly after user interaction with untrusted sites
Track Chromium security advisories through the Chrome Releases blog to identify newly disclosed component flaws

How to Mitigate CVE-2026-87605

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints
Restart the browser after update to ensure the patched binaries are loaded
Verify auto-update policies are enabled and functioning across the fleet

Patch Information

Google addressed CVE-2026-87605 in Chrome 153.0.8010.36 on the Stable Channel for Desktop. Administrators should reference the Chrome Stable Channel Update for full release notes and deploy the update through their standard patch management workflow.

Workarounds

Enforce enterprise policies that block or restrict use of the Contacts Picker API where not required
Deploy phishing-resistant user awareness training to reduce the social engineering component required for exploitation
Apply strict browser isolation or site isolation policies for high-risk user groups until patching completes

bash

# Verify Chrome version on Linux/macOS endpoints
google-chrome --version

# Windows PowerShell version check
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion