CVE-2026-87620: Google Chrome Information Disclosure Flaw

CVE-2026-87620 Overview

CVE-2026-87620 is an observable discrepancy vulnerability in the Scalable Vector Graphics (SVG) component of Google Chrome. The flaw exists in Chrome versions prior to 153.0.8010.36. A remote attacker can obtain sensitive information by convincing a user to load a crafted HTML page. Chromium's internal security triage rated the underlying issue as Low severity, though the National Vulnerability Database assigned a higher score reflecting broader confidentiality impact. The vulnerability maps to [CWE-203]: Observable Discrepancy, a class of side-channel weakness where behavioral differences leak information across security boundaries.

Critical Impact
A remote attacker can extract sensitive cross-origin information from a browser session when a victim visits a malicious page rendering crafted SVG content.

Affected Products

Google Chrome for Desktop versions prior to 153.0.8010.36
Chromium-based browsers using the vulnerable SVG rendering code
Downstream distributions bundling pre-patch Chromium builds

Discovery Timeline

2026-09-09 - CVE-2026-87620 published to the National Vulnerability Database
2026-09-09 - Google publishes Stable Channel Update for Desktop addressing the issue
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87620

Vulnerability Analysis

The vulnerability resides in Chrome's SVG rendering pipeline. An observable discrepancy occurs when the browser exposes measurable differences in behavior, timing, or rendering output that depend on protected data. An attacker can craft an HTML page that embeds SVG content designed to trigger these discrepancies. By observing the differences, the attacker infers information the browser should isolate across origins or security contexts.

Exploitation requires user interaction: the victim must load the attacker-controlled page. No authentication or elevated privileges are needed on the browser side. The scope of leaked information depends on what Chrome's SVG pipeline exposes when processing cross-origin or privileged content.

The issue is tracked in the Chromium Issue Tracker Entry and disclosed in the Google Chrome Desktop Update.

Root Cause

The root cause is a failure to enforce uniform behavior when the SVG renderer handles resources subject to origin restrictions. Differences in rendering paths, layout results, or processing time correlate with attributes of the protected data. This side-channel signal violates the isolation guarantees the browser enforces between origins.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker hosts a page containing crafted SVG markup and lures a user to visit it through phishing, malvertising, or a compromised site. When Chrome renders the page, the SVG payload triggers the discrepancy, and script on the page reads the observable signal to reconstruct sensitive information.

No public proof-of-concept, exploit code, or CISA Known Exploited Vulnerabilities listing exists for this CVE at publication time. See the vendor advisory for technical details.

Detection Methods for CVE-2026-87620

Indicators of Compromise

Chrome browser processes with a version string below 153.0.8010.36 running in the environment
Outbound connections to newly registered or low-reputation domains serving pages with heavy inline SVG content
Repeated page loads from a single user session referencing the same attacker-controlled resource

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag hosts below the patched build
Inspect web proxy logs for URLs delivering unusually large or obfuscated SVG payloads combined with JavaScript timing measurement primitives
Correlate browser telemetry with visits to uncategorized domains preceding anomalous data access events

Monitoring Recommendations

Enable browser version reporting through enterprise management channels to track patch adoption
Log and review Chrome update deployment status through Google's Chrome Browser Cloud Management or equivalent tooling
Monitor DNS and HTTP telemetry for indicators of phishing campaigns that target internal users with SVG-based lure pages

How to Mitigate CVE-2026-87620

Immediate Actions Required

Update all Chrome desktop installations to version 153.0.8010.36 or later
Restart browser sessions after the update completes to ensure the patched binary is loaded
Push the update through enterprise deployment tooling to accelerate coverage across managed fleets

Patch Information

Google addressed CVE-2026-87620 in the Stable Channel update for Desktop released on September 9, 2026. The fixed version is 153.0.8010.36. Administrators should reference the Google Chrome Desktop Update for the full list of security fixes and channel rollout information.

Workarounds

Restrict browsing to trusted sites through enterprise allow-lists until patch deployment completes
Deploy user awareness guidance warning against opening links from unsolicited email or messaging
Enforce automatic Chrome updates through group policy or mobile device management so future security fixes apply without user action

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Verify installed Chrome version on macOS endpoints
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Windows: query the installed version through the registry
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv