CVE-2026-87613: Google Chrome RCE Vulnerability

CVE-2026-87613 Overview

CVE-2026-87613 is an incorrect reference resolution vulnerability in the Extensions component of Google Chrome prior to version 153.0.8010.36. A remote attacker can potentially execute arbitrary code outside the Chrome sandbox by delivering crafted network traffic to a targeted browser instance. The flaw is classified under [CWE-706: Use of Incorrectly-Resolved Name or Reference]. Google's Chromium project rated the underlying issue as Medium severity, while the National Vulnerability Database assigned a Critical rating based on the potential for sandbox escape and full system compromise.

Critical Impact
Successful exploitation allows arbitrary code execution outside the Chrome sandbox, giving attackers the ability to run code with the privileges of the browser process on the underlying host.

Affected Products

Google Chrome versions prior to 153.0.8010.36
Chrome Desktop across supported operating systems
Chromium-based browsers that inherit the vulnerable Extensions reference resolution logic

Discovery Timeline

2026-09-09 - CVE-2026-87613 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87613

Vulnerability Analysis

The vulnerability resides in the Extensions subsystem of Google Chrome. It arises from incorrect reference resolution, mapped to [CWE-706]. In this class of flaw, the browser resolves a name or reference to an object different from the one the security policy expects. Attackers can leverage this mismatch to interact with resources or interfaces that should remain outside the reach of extension-scoped code.

Because extensions run in a constrained renderer context, correct reference resolution is a foundational assumption of the sandbox model. When the resolver returns an unintended object, extension code can reach browser-privileged surfaces. This condition creates a path for sandbox escape and arbitrary code execution on the host.

Root Cause

The root cause is improper resolution of a name or reference inside Chrome's Extensions logic. The resolver associates an identifier with the wrong underlying object at runtime. The vulnerable code path exists in all Chrome builds earlier than 153.0.8010.36.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction, though exploitation complexity is high. A remote attacker delivers crafted network traffic that reaches the Extensions component, likely through a compromised or attacker-controlled resource loaded by an installed extension. Successful exploitation moves the attacker's code from the extension sandbox to the broader browser process, enabling arbitrary code execution outside the sandbox.

No public proof-of-concept exploit has been released. Refer to the Chromium Issue Tracker #501889544 for the underlying technical discussion once access restrictions are lifted.

Detection Methods for CVE-2026-87613

Indicators of Compromise

Chrome processes spawning unexpected child processes such as command shells or scripting hosts shortly after visiting untrusted sites
Extension update or fetch requests to domains not associated with the Chrome Web Store or the extension developer
Anomalous outbound connections initiated by chrome.exe or renderer processes to attacker-controlled infrastructure

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any host running a build earlier than 153.0.8010.36
Alert on process lineage anomalies where Chrome renderer or utility processes launch unsigned binaries or living-off-the-land tools
Correlate browser telemetry with network egress logs to identify extension-driven traffic to newly observed or low-reputation domains

Monitoring Recommendations

Enforce browser version telemetry through endpoint management tools to confirm patch adoption
Monitor extension installation events and permission changes across managed endpoints
Capture DNS and HTTP logs from workstations to detect crafted network traffic targeting extension endpoints

How to Mitigate CVE-2026-87613

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints
Restart the browser after update to ensure the patched binaries load into memory
Audit installed extensions and remove any that are unused, unmaintained, or sourced outside the Chrome Web Store

Patch Information

Google released a fixed Chrome build addressing CVE-2026-87613 in the Stable channel. Details are available in the Google Chrome Desktop Update advisory. The vulnerable code path is remediated in Chrome 153.0.8010.36 and higher. Chromium-based browser vendors should incorporate the corresponding upstream fix.

Workarounds

Restrict extension installation to an allow-list managed through Chrome enterprise policy until patching completes
Deploy network-level filtering to block browser traffic to untrusted domains commonly abused for extension-borne payloads
Disable non-essential extensions on high-value endpoints to reduce exposure to the vulnerable component

bash

# Configuration example: enforce Chrome extension allow-list via enterprise policy (Linux)
sudo mkdir -p /etc/opt/chrome/policies/managed
cat <<'EOF' | sudo tee /etc/opt/chrome/policies/managed/extension_controls.json
{
  "ExtensionInstallBlocklist": ["*"],
  "ExtensionInstallAllowlist": [
    "<approved-extension-id-1>",
    "<approved-extension-id-2>"
  ],
  "BrowserSignin": 2
}
EOF