CVE-2026-87626: Google Chrome Authorization Bypass Vulnerability

CVE-2026-87626 Overview

CVE-2026-87626 is an incorrect authorization vulnerability in the DeviceBoundSessionCredentials component of Google Chrome versions prior to 153.0.8010.36. A remote attacker can bypass the web origin policy by sending crafted network traffic to a vulnerable browser. Chromium's internal security triage rated the issue Medium severity. The flaw is tracked under CWE-863: Incorrect Authorization and affects the Device Bound Session Credentials (DBSC) feature designed to bind session cookies to device-held cryptographic keys.

Critical Impact
A remote attacker can bypass the same-origin protections enforced by Device Bound Session Credentials, potentially exposing session material intended to be restricted to a specific web origin.

Affected Products

Google Chrome desktop versions prior to 153.0.8010.36
Chromium-based browsers that ship the DeviceBoundSessionCredentials implementation from affected upstream builds
Downstream distributions that had not yet integrated the Chrome 153 stable channel update

Discovery Timeline

2026-09-09 - CVE-2026-87626 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87626

Vulnerability Analysis

Device Bound Session Credentials (DBSC) is a Chrome mechanism that ties browser sessions to a private key stored on the device. The feature is intended to prevent session cookie theft by requiring proof-of-possession of that key when a session is refreshed. CVE-2026-87626 breaks an authorization check inside this component, permitting a remote attacker to bypass the browser's web origin policy through crafted network responses.

The practical effect is that logic which should reject cross-origin interactions with device-bound session material can be tricked into accepting them. This weakens the isolation guarantee DBSC was designed to provide. Because the attack occurs over the network and targets browser session handling, exploitation requires only that a victim's browser process attacker-influenced traffic.

The EPSS probability is 0.207%, and no public exploit or CISA KEV listing is associated with this identifier at the time of publication.

Root Cause

The root cause is an incorrect authorization decision [CWE-863] within DeviceBoundSessionCredentials. The component fails to correctly enforce the origin boundary when evaluating whether a given request is authorized to interact with a bound session. Specific implementation details are restricted in the Chromium issue tracker until sufficient user upgrade coverage is reached.

Attack Vector

Exploitation requires a remote attacker capable of delivering crafted network traffic to the victim browser. This can be achieved by hosting a malicious site, injecting responses via a compromised intermediary, or leveraging an attacker-in-the-middle position on the network path. Once the crafted traffic is processed, the flawed authorization check allows the attacker to cross the web origin boundary that DBSC is meant to enforce.

No verified proof-of-concept code is available. Refer to the Google Chrome Stable Update advisory for vendor guidance.

Detection Methods for CVE-2026-87626

Indicators of Compromise

Chrome installations reporting versions below 153.0.8010.36 in browser inventory or user-agent telemetry
Unexpected outbound requests referencing DBSC session refresh endpoints from hosts running outdated Chrome builds
Session reuse patterns where the same authenticated session appears from multiple network origins in short succession

Detection Strategies

Inventory endpoints and enumerate installed Chrome and Chromium-derivative versions, flagging any build older than 153.0.8010.36
Correlate authentication logs on protected web applications for session tokens observed from unexpected client fingerprints or geographies
Monitor TLS-terminated proxy logs for anomalous request sequences targeting DBSC-enabled origins from outdated browser versions

Monitoring Recommendations

Ingest browser version telemetry into a centralized data lake to identify unpatched fleets in real time
Alert on authentication anomalies for applications that rely on DBSC for session binding, including session refresh failures followed by successful cross-origin use
Track vendor advisories at chromereleases.googleblog.com for follow-up fixes or related regressions

How to Mitigate CVE-2026-87626

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints
Force browser restarts through enterprise management tooling to ensure the patched binary is loaded
Audit Chromium-based browsers such as Edge, Brave, and Opera and apply corresponding vendor updates once released

Patch Information

Google addressed the vulnerability in the Chrome Stable channel with version 153.0.8010.36. Details are available in the Google Chrome Stable Update announcement and the corresponding Chromium Issue #553155590. Deploy the update through standard patch management channels or allow Chrome's built-in updater to apply the new build.

Workarounds

No vendor-supplied workaround exists; upgrading Chrome is the only supported remediation
Where immediate patching is not possible, restrict browser access to untrusted networks and enforce egress filtering on client subnets
Consider disabling or limiting features that depend on DBSC on affected fleets until the update is applied

bash

# Verify installed Chrome version on Linux and macOS endpoints
google-chrome --version
# Expected output on patched systems:
# Google Chrome 153.0.8010.36 or higher