CVE-2026-87606: Google Chrome Site Isolation Auth Bypass

CVE-2026-87606 Overview

CVE-2026-87606 is a missing authorization vulnerability [CWE-862] in the Site Isolation component of Google Chrome. The flaw affects Chrome versions prior to 153.0.8010.36. A remote attacker who has already compromised the renderer process can bypass site isolation using a crafted HTML page. Google's Chromium project rates the underlying security severity as Medium, while NVD scores the CVE at 8.1 due to network exploitability and high impact on confidentiality and integrity.

Critical Impact
An attacker with an existing renderer compromise can defeat Chrome's cross-site process isolation boundary, enabling cross-origin data theft and tampering across sites the victim visits.

Affected Products

Google Chrome Desktop versions prior to 153.0.8010.36
Chromium-based browsers that inherit the Site Isolation implementation from upstream builds prior to 153.0.8010.36
All supported desktop operating systems (Windows, macOS, Linux) running vulnerable Chrome builds

Discovery Timeline

2026-09-09 - CVE-2026-87606 published to NVD
2026-09-10 - Last updated in NVD database
2026-09 - Google releases Chrome Stable Channel update fixing the issue (see Google Chrome Stable Update)

Technical Details for CVE-2026-87606

Vulnerability Analysis

Site Isolation is Chrome's security architecture that renders documents from different sites in separate operating system processes. This boundary prevents a compromised renderer from reading data belonging to other origins. CVE-2026-87606 is a missing authorization defect [CWE-862] in that enforcement path. The browser code fails to verify that a renderer process is entitled to perform a specific cross-site action before honoring the request.

The attack requires two preconditions. First, the attacker must already control a renderer process, typically through a prior memory-corruption or logic bug. Second, the victim must load a crafted HTML page that triggers the unauthorized cross-site action. Because the renderer already runs attacker-controlled code, the missing check turns a same-origin foothold into cross-origin access.

The CVSS vector notes user interaction is required, aligning with the need for the victim to navigate to attacker content. Details are tracked in Chromium Issue Tracker #495933780.

Root Cause

The root cause is a missing authorization check on an interprocess communication (IPC) path exposed to renderer processes. Site Isolation depends on the browser process rejecting requests that violate origin boundaries. When that check is absent, the browser trusts the renderer's assertion of identity and processes the request across sites.

Attack Vector

Exploitation is a chained scenario. An attacker first executes code inside a renderer through a separate vulnerability or malicious extension. The attacker then serves a crafted HTML page that invokes the unauthorized Site Isolation path. Successful exploitation lets the compromised renderer act against origins it should not reach, breaking the per-site process boundary.

No public proof-of-concept, exploit database entry, or CISA KEV listing is associated with CVE-2026-87606 at this time. See Chromium Issue Tracker #495933780 for further technical context.

Detection Methods for CVE-2026-87606

Indicators of Compromise

Chrome renderer processes generating unexpected IPC traffic patterns to the browser process, particularly cross-site navigation or resource requests inconsistent with the visible tab origin
Browser telemetry showing document loads or fetches attributed to origins that do not match the site associated with the renderer process
Reports of Chrome instances still running builds below 153.0.8010.36 after the security update was published

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any host running a build older than 153.0.8010.36
Correlate renderer crashes, sandbox escape indicators, or exploit-kit deliveries with subsequent anomalous cross-origin activity in browser logs
Monitor extension installations and script injections that could serve as the initial renderer-compromise stage in a chained exploit

Monitoring Recommendations

Ingest Chrome enterprise reporting and endpoint telemetry into a central analytics platform to identify outdated browser versions in near real time
Alert on suspicious child-process behavior spawned by chrome.exe or the platform equivalent, which may indicate a prior renderer-stage exploit
Track outbound connections from browser processes to newly registered or low-reputation domains that may host crafted HTML exploit pages

How to Mitigate CVE-2026-87606

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all Windows, macOS, and Linux endpoints
Restart Chrome after the update to ensure the patched binary is loaded, since running instances continue to use the vulnerable code
Audit Chromium-based browsers and embedded WebView components for downstream builds incorporating the fix

Patch Information

Google addressed CVE-2026-87606 in the Chrome Stable Channel release documented in the Google Chrome Stable Update advisory. Administrators should deploy version 153.0.8010.36 or later through enterprise update channels such as Chrome Browser Cloud Management, Group Policy, or Jamf. Chromium downstream projects should rebase to the corresponding upstream commit referenced in Chromium Issue Tracker #495933780.

Workarounds

Enforce automatic Chrome updates through enterprise policy so the patched version is delivered without user action
Restrict installation of untrusted browser extensions, which are a common initial vector for renderer compromise required by this chain
Apply strict web content filtering to reduce exposure to attacker-controlled HTML pages hosting exploit chains

bash

# Configuration example: enforce Chrome auto-update on Windows via Group Policy registry keys
reg add "HKLM\SOFTWARE\Policies\Google\Update" /v AutoUpdateCheckPeriodMinutes /t REG_DWORD /d 60 /f
reg add "HKLM\SOFTWARE\Policies\Google\Update" /v UpdateDefault /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Google\Update\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v Update /t REG_DWORD /d 1 /f