CVE-2026-87610: Google Chrome Omnibox Auth Bypass Flaw

CVE-2026-87610 Overview

CVE-2026-87610 is an incorrect authorization vulnerability [CWE-863] in the Omnibox component of Google Chrome. Versions prior to 153.0.8010.36 allow a remote attacker to bypass system access restrictions and reach a privileged page through a crafted HTML page. Google's Chromium security team rated this issue as Medium severity. Exploitation requires user interaction, typically navigation to attacker-controlled web content that leverages the Omnibox flaw to escalate access.

Critical Impact
A remote attacker can bypass browser access controls and reach privileged internal Chrome pages by serving a crafted HTML page, expanding the attack surface beyond the standard renderer sandbox boundary.

Affected Products

Google Chrome Desktop versions prior to 153.0.8010.36
Chromium-based browsers sharing the vulnerable Omnibox code path
All supported desktop platforms (Windows, macOS, Linux) running affected Chrome builds

Discovery Timeline

2026-09-09 - CVE-2026-87610 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87610

Vulnerability Analysis

The flaw resides in the Omnibox, the combined address and search bar in Chrome. The Omnibox mediates navigation requests and enforces restrictions on which origins may load privileged internal pages, such as chrome:// URLs. Incorrect authorization logic in this component permits a remote attacker to trigger navigation into a privileged page from an untrusted origin.

Because privileged pages run with elevated browser capabilities, reaching them from web content undermines the isolation model between untrusted web origins and browser-internal surfaces. This class of issue is tracked under CWE-863: Incorrect Authorization.

Root Cause

The vulnerability stems from an authorization check in the Omnibox that fails to correctly validate the origin or navigation source before allowing transition into a privileged page. The check accepts navigations that should be rejected, breaking the boundary between web-initiated navigations and privileged internal navigations. Additional technical detail is tracked in Chromium Issue #547592631.

Attack Vector

Exploitation requires a victim to load a crafted HTML page in a vulnerable Chrome build. The attacker-controlled page issues a navigation sequence that the Omnibox authorization logic misclassifies as permitted. The result is access to a privileged page that is normally restricted to browser-internal callers. No authentication is required, and the delivery mechanism is standard web traffic.

No verified exploit code is publicly available. See the Google Chrome Stable Channel Update for the vendor's release notes.

Detection Methods for CVE-2026-87610

Indicators of Compromise

Browser telemetry showing navigations from web origins that resolve to chrome:// or other privileged internal URLs.
Chrome process instances running versions earlier than 153.0.8010.36 on managed endpoints.
Web traffic to attacker-controlled pages followed by anomalous browser state changes or new privileged UI surfaces.

Detection Strategies

Inventory Chrome versions across the fleet and flag any host running a build below 153.0.8010.36.
Correlate browser navigation logs with process telemetry to identify web-initiated transitions into privileged pages.
Hunt for outbound requests to newly registered domains hosting HTML that references chrome:// URLs in scripts, links, or iframes.

Monitoring Recommendations

Enable enterprise reporting via Chrome Browser Cloud Management to collect version and navigation events centrally.
Alert on Chrome installations that fail to update within the organization's defined patch window.
Monitor endpoint EDR telemetry for Chrome child processes launching with unexpected command-line flags or renderer configurations.

How to Mitigate CVE-2026-87610

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all Windows, macOS, and Linux endpoints.
Restart Chrome after the update to ensure the patched binary is loaded across all running sessions.
Verify auto-update is enabled and functioning on managed endpoints, and force update deployment where it is disabled.

Patch Information

Google released the fix in the Chrome Stable channel update at version 153.0.8010.36. Administrators should validate deployment against the Google Chrome Stable Channel Update advisory and confirm remediation by checking chrome://settings/help on managed hosts.

Workarounds

Restrict user navigation to untrusted sites through web filtering or secure web gateway policies until patching completes.
Deploy Chrome enterprise policies that limit access to privileged internal pages where feasible.
Use browser isolation for high-risk user groups until all endpoints report the patched version.

bash

# Verify installed Chrome version on Linux/macOS endpoints
google-chrome --version

# Windows: query installed version via registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version