CVE-2026-87608: Google Chrome FedCM Auth Bypass Vulnerability

CVE-2026-87608 Overview

CVE-2026-87608 is an improper certificate validation vulnerability in the Federated Credential Management (FedCM) component of Google Chrome versions prior to 153.0.8010.36. The flaw allows a remote attacker who leverages social engineering to bypass the web origin policy through crafted network traffic. Chromium engineers assigned the issue a security severity of Low. The weakness is categorized under CWE-295: Improper Certificate Validation.

Critical Impact
An attacker able to induce user interaction and manipulate network traffic can bypass Chrome's web origin policy through FedCM, undermining a boundary designed to isolate federated identity flows between distinct origins.

Affected Products

Google Chrome desktop builds prior to 153.0.8010.36
Chromium-based browsers that inherit the FedCM implementation from the affected Chrome versions
Environments where FedCM is used for federated sign-in flows

Discovery Timeline

2026-09-09 - CVE-2026-87608 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database
2026-09-10 - Exploit Prediction Scoring System (EPSS) data recorded

Technical Details for CVE-2026-87608

Vulnerability Analysis

The vulnerability resides in Chrome's FedCM implementation, which mediates federated identity exchanges between an identity provider (IdP) and a relying party (RP). FedCM is designed to enforce origin-based trust so that credential responses can only be attributed to the intended IdP origin. Improper certificate validation in this flow weakens that guarantee. An attacker positioned to manipulate network traffic can present crafted responses that Chrome fails to reject on certificate grounds. Combined with social engineering, the attacker can trick a user into initiating a FedCM flow that the browser then treats as originating from a trusted web origin.

Root Cause

The root cause is inadequate validation of the certificate chain associated with a FedCM endpoint. Instead of strictly binding the credential exchange to a fully validated TLS identity, the affected code path accepts responses that should be rejected. This corresponds directly to CWE-295, where the software does not verify, or improperly verifies, a certificate before establishing trust. The result is a mismatch between the web origin policy Chrome expects to enforce and the actual origin the browser trusts during a FedCM transaction.

Attack Vector

Exploitation requires two conditions. First, the attacker must influence the network path between the victim's browser and a FedCM identity provider, for example through a hostile network, DNS manipulation, or a compromised upstream service. Second, the attacker must convince the user to initiate a federated sign-in through social engineering. The Chromium project rated the severity as Low, and the EPSS score reflects a low near-term likelihood of observed exploitation. See the Chromium Issue Tracker entry #540072282 and the Chrome Stable channel update for the vendor advisory.

Detection Methods for CVE-2026-87608

Indicators of Compromise

Chrome browser processes running versions earlier than 153.0.8010.36 in enterprise inventory data
Unexpected FedCM sign-in prompts on origins that do not normally federate with the requesting relying party
TLS sessions to IdP endpoints presenting certificates with invalid chains, mismatched Subject Alternative Names, or untrusted issuers

Detection Strategies

Inventory installed Chrome and Chromium-derivative versions across managed endpoints and flag hosts below 153.0.8010.36
Inspect proxy and TLS inspection logs for FedCM-related requests to /.well-known/web-identity and IdP config endpoints served with anomalous certificates
Correlate browser telemetry with identity provider sign-in logs to identify federated authentications that lack a corresponding legitimate IdP session

Monitoring Recommendations

Alert on outbound HTTPS connections from browsers to FedCM endpoints where the server certificate fails standard chain validation at the proxy
Monitor for repeated federated authentication attempts against high-value relying parties initiated from unmanaged or off-VPN networks
Track Chrome update compliance as a continuous control and generate exceptions when hosts remain on vulnerable versions after the patch release

How to Mitigate CVE-2026-87608

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all desktop platforms using managed update policies
Restart Chrome after the update so that the patched binary is loaded on every managed endpoint
Verify that Chromium-based browsers in the environment have absorbed the upstream fix before treating them as remediated

Patch Information

Google addressed the vulnerability in the Chrome Stable channel update announced in the Chrome Releases blog. The fix is included in Chrome 153.0.8010.36 for desktop. Technical remediation details are tracked in Chromium Issue #540072282. Administrators should push the update through Chrome Browser Cloud Management, Group Policy, or their configuration management platform of choice.

Workarounds

Disable FedCM through enterprise policy where federated sign-in is not required for business workflows
Enforce strict TLS inspection and certificate pinning on egress paths used for federated authentication
Provide user awareness guidance to reject unexpected federated sign-in prompts, since exploitation requires social engineering

bash

# Configuration example: enforce Chrome minimum version and disable FedCM via policy on managed endpoints
# Windows Group Policy registry keys under HKLM\SOFTWARE\Policies\Google\Chrome
TargetVersionPrefix = "153.0.8010.36"
FedCmEnabled = 0