CVE-2026-87629 Overview
CVE-2026-87629 is an incorrect authorization vulnerability in the Sources component of Google Chrome prior to version 153.0.8010.36. A remote attacker can leverage social engineering to trick a user into loading a crafted HTML page, resulting in the disclosure of sensitive information. The flaw is tracked upstream as a Chromium Low severity issue but scores in the medium range under CVSS v3.1 due to network-based exploitation and high confidentiality impact. Successful exploitation requires user interaction, which limits mass exploitation but remains viable in targeted phishing scenarios. Google addressed the issue in the Stable channel update released in September 2026.
Critical Impact
A remote attacker can leak sensitive browser-context information from a targeted user through a crafted HTML page combined with social engineering.
Affected Products
- Google Chrome versions prior to 153.0.8010.36
- Chromium-based browsers that inherit the Sources component logic
- Desktop Stable channel builds for Windows, macOS, and Linux
Discovery Timeline
- 2026-09-09 - CVE-2026-87629 published to the National Vulnerability Database (NVD)
- 2026-09-09 - Last updated in the NVD database
Technical Details for CVE-2026-87629
Vulnerability Analysis
The vulnerability resides in the Sources feature of Chrome, which is part of the browser's DevTools surface used to inspect scripts and resources loaded by web pages. Chrome fails to enforce correct authorization checks on this component, permitting a crafted page to reach data it should not be able to access. Because the flaw requires user interaction, an attacker must first convince the victim to visit an attacker-controlled page or perform a specific action within the browser. The impact is limited to confidentiality; the vulnerability does not corrupt data or affect availability.
Root Cause
The underlying weakness is classified as [CWE-863: Incorrect Authorization]. The Sources component performs an authorization decision that does not fully validate the requester's privilege level or origin. As a result, a crafted HTML document can bypass the intended access boundary and read data reserved for privileged browser contexts.
Attack Vector
Exploitation is network-based and does not require authentication. An attacker hosts a crafted HTML page and uses phishing, malvertising, or a compromised website to lure the victim. Once the user interacts with the page, the malicious content exercises the flawed authorization path in Sources to exfiltrate sensitive browser data. Refer to the Chromium Issue Tracker Entry and the Google Chrome Stable Update for vendor-published details.
No public proof-of-concept code has been released for CVE-2026-87629 at the time of publication.
Detection Methods for CVE-2026-87629
Indicators of Compromise
- Chrome browser process versions below 153.0.8010.36 observed in endpoint inventory data
- Outbound connections from Chrome to newly registered or low-reputation domains hosting HTML content shortly after user click events
- Unexpected DevTools or Sources panel activity correlated with the visit of an untrusted page
Detection Strategies
- Query endpoint telemetry for Chrome executable versions and flag any host running a build older than 153.0.8010.36.
- Correlate email or messaging URL click events with subsequent Chrome navigation to unrated domains to identify social engineering delivery.
- Alert on browser child-process spawns or file writes that follow visits to newly observed external hosts.
Monitoring Recommendations
- Track Chrome update compliance via patch management and endpoint inventory reports.
- Ingest browser and proxy logs into a centralized data lake to enable cross-source correlation of phishing delivery patterns.
- Monitor threat intelligence feeds for domains and URLs weaponizing CVE-2026-87629.
How to Mitigate CVE-2026-87629
Immediate Actions Required
- Update all Chrome installations to version 153.0.8010.36 or later through managed software distribution.
- Force-restart Chrome sessions to ensure the patched binary is loaded on user endpoints.
- Reinforce user awareness on phishing and unsolicited links that request browser interaction.
Patch Information
Google released the fix in the Chrome Stable channel update documented in the Google Chrome Stable Update. Administrators should confirm that endpoints report a Chrome version of 153.0.8010.36 or higher. Chromium downstream vendors should apply the corresponding upstream patch referenced in the Chromium Issue Tracker Entry.
Workarounds
- Restrict browsing to trusted domains using enterprise URL filtering until patches are deployed.
- Deploy browser policies that limit access to DevTools features on managed endpoints where feasible.
- Increase email gateway scrutiny for links leading to newly registered domains during the patch rollout window.
# Verify installed Chrome version on Linux endpoints
google-chrome --version
# Windows: query the installed Chrome version from the registry
reg query "HKLM\SOFTWARE\WOW6432Node\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
