CVE-2026-87619: Google Chrome Information Disclosure Flaw

CVE-2026-87619 Overview

CVE-2026-87619 is an observable discrepancy vulnerability in the Prefetch component of Google Chrome. A remote attacker can leak cross-origin data by serving a crafted HTML page to a targeted user. The flaw affects Chrome versions prior to 153.0.8010.36 and is classified under [CWE-203: Observable Discrepancy]. Chromium's internal security team rated the underlying issue as Low severity, while NVD assigns a medium score reflecting the network-based, cross-origin data exposure risk.

Critical Impact
A remote attacker who convinces a user to visit a malicious page can infer or extract cross-origin data through observable differences in Chrome's Prefetch behavior, undermining the same-origin policy.

Affected Products

Google Chrome versions prior to 153.0.8010.36 (Desktop, Stable channel)
Chromium-based browsers that share the vulnerable Prefetch implementation
All operating systems running the affected Chrome desktop builds

Discovery Timeline

2026-09-09 - CVE-2026-87619 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87619

Vulnerability Analysis

The vulnerability resides in Chrome's Prefetch subsystem, which speculatively fetches resources to reduce navigation latency. An observable discrepancy exists in how Prefetch processes or reports the state of cross-origin resources. An attacker hosting a crafted HTML page can measure these differences to infer information about resources served from other origins.

This class of flaw, tracked as [CWE-203], typically arises when timing, response size, cache state, or error signaling differs based on the properties of a protected resource. Even without directly reading response bodies, the attacker can derive sensitive attributes such as authentication state or the presence of specific content.

Exploitation requires user interaction, specifically navigating to attacker-controlled content, and does not require prior authentication. No public proof-of-concept exploit is currently listed for this CVE.

Root Cause

The root cause is an inadequate boundary between speculatively prefetched cross-origin resources and observable page-level state. Prefetch operations expose measurable side effects that vary depending on cross-origin response characteristics, violating the isolation expected by the same-origin policy. See Chromium Issue #497433347 for the tracked technical details.

Attack Vector

The attack vector is network-based and requires user interaction. The attacker delivers a crafted HTML page — through phishing, malvertising, or a compromised site — that instructs the browser to prefetch targeted cross-origin URLs. The page then measures observable properties of those prefetches to leak information across origins. No verified exploitation code is available; refer to the Google Chrome Stable Update advisory for vendor commentary.

Detection Methods for CVE-2026-87619

Indicators of Compromise

Outbound browser requests to unfamiliar domains hosting HTML with dense <link rel="prefetch"> tags targeting sensitive third-party origins.
User navigation to newly registered or low-reputation domains followed by anomalous prefetch traffic to authenticated web applications.
Unusual patterns of speculative cross-origin fetches originating from a single tab or session.

Detection Strategies

Inspect web proxy and DNS logs for high volumes of prefetch-style requests to cross-origin endpoints unrelated to the referring site.
Correlate browser telemetry with threat intelligence on domains known to serve credential-harvesting or side-channel measurement pages.
Track Chrome version inventory across managed endpoints and flag hosts running builds earlier than 153.0.8010.36.

Monitoring Recommendations

Enable browser management telemetry to report installed Chrome versions and patch status to a central console.
Ingest web gateway and endpoint browsing logs into a security data lake to hunt for prefetch abuse patterns.
Alert on user visits to suspicious HTML pages immediately followed by cross-origin requests to internal or SaaS applications.

How to Mitigate CVE-2026-87619

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints.
Restart the browser after the update to ensure patched Prefetch code paths are loaded.
Verify auto-update mechanisms are enabled and functioning across the Windows, macOS, and Linux fleet.

Patch Information

Google addressed the issue in the Stable channel update to 153.0.8010.36. Administrators should deploy the fix through enterprise browser management, Group Policy, or Chrome Browser Cloud Management. Reference the Google Chrome Stable Update release notes and Chromium Issue #497433347 for the underlying fix.

Workarounds

Restrict access to untrusted websites using enterprise web filtering until Chrome is patched.
Deploy Chrome policies that disable network prediction and prefetching (NetworkPredictionOptions) as a temporary control.
Educate users to avoid opening unsolicited links, particularly from unknown senders, to reduce exposure to crafted HTML pages.

bash

# Configuration example: disable network prediction via Chrome enterprise policy
# Windows registry (HKLM):
reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v NetworkPredictionOptions /t REG_DWORD /d 2 /f

# macOS/Linux managed policy JSON:
# /etc/opt/chrome/policies/managed/network_prediction.json
{
  "NetworkPredictionOptions": 2
}