CVE-2026-87622: Google Chrome Auth Bypass Vulnerability

CVE-2026-87622 Overview

CVE-2026-87622 is a missing authorization vulnerability in the Federated Credential Management (FedCM) component of Google Chrome. Versions prior to 153.0.8010.36 fail to enforce web origin policy checks in FedCM flows. A remote attacker can host a crafted HTML page that leverages the missing check to bypass origin restrictions. Chromium rates the security severity as Medium. Exploitation requires user interaction with the attacker-controlled page. The weakness is classified under CWE-862: Missing Authorization.

Critical Impact
A remote attacker can bypass web origin policy in FedCM through a crafted HTML page, potentially exposing federated identity information across origins.

Affected Products

Google Chrome versions prior to 153.0.8010.36 (Desktop Stable channel)

Discovery Timeline

2026-09-09 - CVE-2026-87622 published to NVD
2026-09-09 - Last updated in NVD database
2026-09 - Google releases fix in Chrome Stable channel per the Chrome Releases advisory

Technical Details for CVE-2026-87622

Vulnerability Analysis

FedCM is Chrome's browser API that mediates federated sign-in between relying parties and identity providers. The API is intended to enforce strict same-origin and cross-origin policy checks to keep credential exchanges scoped to authorized parties. In vulnerable builds, an authorization check is missing along a code path invoked during a FedCM request. This allows an attacker-controlled origin to interact with the API in ways that should be restricted by web origin policy. The confidentiality impact is limited, with no direct effect on integrity or availability of the browser process. Impact is confined to information accessible through the FedCM surface rather than arbitrary code execution.

Root Cause

The root cause is a missing authorization check ([CWE-862]) within the FedCM implementation in Chromium. The component fails to validate that the requesting origin is permitted to perform the operation. Additional technical context is tracked in the Chromium issue tracker entry 517602176.

Attack Vector

Exploitation is remote and requires the victim to visit or interact with a crafted HTML page. The attacker does not need prior authentication or elevated privileges on the target system. The user interaction requirement typically involves navigating to attacker-controlled content or clicking an embedded element that triggers a FedCM flow. Successful exploitation lets the attacker bypass web origin policy scoping within FedCM.

No public proof-of-concept is available for CVE-2026-87622 at the time of publication. Refer to the Chromium issue tracker for technical details as they become public.

Detection Methods for CVE-2026-87622

Indicators of Compromise

Chrome browser processes reporting version strings earlier than 153.0.8010.36 in enterprise telemetry inventories.
Outbound browser traffic to unfamiliar identity provider endpoints from users who did not initiate a federated sign-in.
Anomalous FedCM API invocations originating from pages loaded outside sanctioned relying-party domains.

Detection Strategies

Inventory installed Chrome versions across the fleet and flag hosts running builds below 153.0.8010.36.
Correlate web proxy or DNS logs with browsing sessions to identify crafted HTML pages that trigger unexpected federated login prompts.
Ingest browser and endpoint telemetry into a centralized data lake and hunt for FedCM-related events tied to newly registered or low-reputation domains.

Monitoring Recommendations

Track Chrome update compliance through enterprise management tools such as Chrome Browser Enterprise Core or MDM.
Alert on high-risk browsing categories and newly seen domains hosting sign-in flows.
Monitor identity provider logs for authentication attempts that lack a corresponding user-initiated relying-party session.

How to Mitigate CVE-2026-87622

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all Windows, macOS, and Linux endpoints.
Restart Chrome after applying the update to ensure the patched binary is active.
Verify update propagation across managed fleets and remediate hosts that fail to receive the Stable channel update.

Patch Information

Google addressed CVE-2026-87622 in the Chrome Stable channel update announced on the Chrome Releases blog. The fix is included in Chrome 153.0.8010.36 and later. Chromium-based browsers that consume upstream patches should also apply their vendor's corresponding release.

Workarounds

Restrict access to untrusted websites through enterprise web filtering while patch deployment completes.
Enforce Chrome auto-update policies to reduce the window of exposure for unmanaged devices.
Educate users to avoid interacting with unsolicited sign-in prompts on unfamiliar pages until updates are verified.

bash

# Verify installed Chrome version on Linux/macOS
google-chrome --version

# Windows: query the installed version from the registry
reg query "HKLM\SOFTWARE\WOW6432Node\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv