CVE-2026-87623 Overview
CVE-2026-87623 is an observable discrepancy vulnerability in the Document Object Model (DOM) implementation of Google Chrome versions prior to 153.0.8010.36. The flaw allows a remote attacker to obtain sensitive information by luring a user to a crafted HTML page. Exploitation requires user interaction and social engineering, but no authentication or elevated privileges. Google classifies the Chromium security severity as Medium. The vulnerability maps to [CWE-203: Observable Discrepancy], a side-channel weakness where behavioral differences leak information across security boundaries.
Critical Impact
A remote attacker can extract confidential data from the browser context by measuring observable differences in DOM behavior on a specially crafted page.
Affected Products
- Google Chrome (Desktop) versions prior to 153.0.8010.36
- Chromium-based browsers sharing the affected DOM implementation
- All desktop platforms served by the Chrome Stable channel
Discovery Timeline
- 2026-09-09 - CVE-2026-87623 published to the National Vulnerability Database
- 2026-09-09 - Google publishes the Stable Channel update advisory addressing the issue
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-87623
Vulnerability Analysis
The vulnerability resides in Chrome's DOM implementation and belongs to the observable discrepancy class of side-channel weaknesses. An attacker crafts an HTML page that measures differences in how the browser handles specific DOM operations. Those differences reveal information that should remain isolated across origins or sessions. The attack model requires the victim to visit the malicious page, satisfying the user-interaction requirement.
The scope stays confined to the browser, and the flaw does not permit code execution or data modification. However, sensitive information such as cross-origin state, resource presence, or user context can leak to the attacker's script. Google addressed the issue in Chrome Stable 153.0.8010.36. Refer to the Google Chrome Update Announcement and the Chromium Issue Tracker Entry for vendor context.
Root Cause
The root cause is a behavioral discrepancy in DOM processing that varies based on protected state. Attacker-controlled scripts can distinguish between outcomes that should be indistinguishable to untrusted content. This category of defect ([CWE-203]) typically arises from timing differences, error handling variations, or state-dependent responses in shared code paths.
Attack Vector
Exploitation occurs over the network and requires user interaction. The attacker hosts a crafted HTML page and uses phishing, malvertising, or a compromised site to drive victim traffic. Once loaded, embedded JavaScript observes DOM behavior and reconstructs sensitive information. No credentials, extensions, or local access are required.
No public exploit or proof-of-concept has been published, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2026-87623
Indicators of Compromise
- Endpoints running Chrome builds earlier than 153.0.8010.36 after the patch release date
- Browser sessions loading unfamiliar HTML pages that execute repeated DOM measurement scripts
- Web proxy logs showing user redirects from phishing or malvertising infrastructure to unknown single-page HTML resources
Detection Strategies
- Inventory installed Chrome versions across managed endpoints and flag any build below 153.0.8010.36.
- Inspect web gateway logs for pages that combine minimal content with high-frequency script activity indicative of side-channel probing.
- Correlate browser telemetry with threat intelligence feeds covering domains hosting Chromium side-channel research or exploit kits.
Monitoring Recommendations
- Enable centralized reporting of browser version and update status through enterprise browser management tooling.
- Monitor DNS and HTTP telemetry for traffic to newly registered or low-reputation domains delivering standalone HTML payloads.
- Track user reports of phishing lures targeting Chrome users following the September 2026 Stable Channel advisory.
How to Mitigate CVE-2026-87623
Immediate Actions Required
- Update Google Chrome to version 153.0.8010.36 or later on all managed desktops.
- Force a browser relaunch after the update so the patched binaries load in active sessions.
- Audit third-party Chromium-based browsers and apply their vendor updates once available.
Patch Information
Google released the fix in Chrome Stable 153.0.8010.36 via the September 2026 Stable Channel update. Deployment details are documented in the Google Chrome Update Announcement. Additional engineering context is tracked in the Chromium Issue Tracker Entry.
Workarounds
- Restrict browsing to trusted sites through enterprise URL filtering until patch deployment completes.
- Disable JavaScript on untrusted origins using enterprise policy for high-risk user groups.
- Increase user awareness training focused on phishing links that redirect to unfamiliar HTML pages.
# Verify Chrome version on Windows endpoints
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv
# Verify Chrome version on macOS endpoints
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString
# Verify Chrome version on Linux endpoints
google-chrome --version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
