CVE-2026-87611: Google Chrome Auth Bypass Vulnerability

CVE-2026-87611 Overview

CVE-2026-87611 is a missing authorization vulnerability [CWE-862] in the FileSystem component of Google Chrome. The flaw affects Chrome versions prior to 153.0.8010.36. A remote attacker who has already compromised the renderer process can obtain cross-origin data by serving a crafted HTML page to the victim. Chromium classifies the security severity as Medium, while the assigned CVSS 3.1 base score is 3.1 (LOW). Exploitation requires user interaction and prior compromise of the renderer, which raises attack complexity. Google addressed the issue in the Stable channel update for desktop.

Critical Impact
Cross-origin data disclosure through the FileSystem API when the renderer process is already compromised.

Affected Products

Google Chrome for Desktop prior to 153.0.8010.36
Chromium-based browsers that inherit the FileSystem implementation prior to the fix
Downstream distributions bundling vulnerable Chrome builds

Discovery Timeline

2026-09-09 - CVE-2026-87611 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87611

Vulnerability Analysis

The vulnerability resides in the FileSystem component of Google Chrome. Chrome's FileSystem API allows web content to read and write sandboxed files scoped to a specific origin. An authorization check enforcing the same-origin boundary is missing in the affected code path. A compromised renderer process can leverage this gap to request FileSystem resources associated with a different origin. The result is disclosure of cross-origin data that the same-origin policy is designed to protect. Exploitation depends on the attacker first achieving renderer compromise through a separate vulnerability, then luring the user to load a crafted HTML page.

Root Cause

The root cause is a missing authorization check [CWE-862] in the FileSystem code path. Chrome does not verify that the requesting origin is authorized to access the targeted FileSystem resource. Without this check, the browser process honors requests from a renderer that should not have access.

Attack Vector

Exploitation requires two conditions. First, the attacker must already control the renderer process, typically by chaining a separate renderer bug. Second, the victim must load attacker-controlled HTML in the compromised context. The attacker then issues FileSystem requests targeting other origins and receives data across the origin boundary.

No verified public proof-of-concept exists for this issue. See the Chromium issue tracker entry #495876543 for technical details once access is granted.

Detection Methods for CVE-2026-87611

Indicators of Compromise

Chrome browser processes running versions earlier than 153.0.8010.36 across managed endpoints
Renderer process crashes or anomalous child-process spawning preceding suspicious network activity
Unexpected access to Chrome's File System storage directories under user profile paths

Detection Strategies

Inventory installed Chrome versions across the estate and flag builds below 153.0.8010.36
Correlate renderer sandbox escape indicators with subsequent FileSystem read activity in endpoint telemetry
Monitor for HTML payloads served from untrusted origins that attempt to invoke FileSystem APIs across origins

Monitoring Recommendations

Enable browser telemetry forwarding to a central log store for version and crash visibility
Alert on Chrome updates that stall on end-user devices beyond the vendor patch window
Track outbound connections from browser processes to newly registered or low-reputation domains

How to Mitigate CVE-2026-87611

Immediate Actions Required

Update Google Chrome to 153.0.8010.36 or later on all Windows, macOS, and Linux endpoints
Restart browser sessions after applying the update to ensure the patched binary is loaded
Validate patch deployment through software inventory and enforce compliance for non-updated devices

Patch Information

Google released the fix in the Chrome Stable channel. Refer to the Chrome Stable Channel Update advisory for release notes and the full list of addressed issues. Chromium-based browsers should rebase on the fixed Chromium version and issue downstream updates.

Workarounds

Enforce automatic Chrome updates through enterprise policy to close the exposure window
Restrict user browsing to trusted origins via web filtering while patch rollout completes
Apply site isolation policies and block execution of untrusted HTML from external sources

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Windows: query the installed version via registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version