CVE-2026-87631 Overview
CVE-2026-87631 is a missing authorization vulnerability in the Document Object Model (DOM) implementation of Google Chrome prior to version 153.0.8010.36. A remote attacker can potentially leak sensitive information by inducing a user to visit a crafted HTML page. Chromium engineers rated the underlying security severity as Low, while the National Vulnerability Database assigns a higher CVSS base score reflecting the network attack vector and high confidentiality impact. The flaw is tracked under CWE-862: Missing Authorization.
Critical Impact
Remote attackers can leak sensitive information from the browser context through a crafted HTML page delivered to a user who interacts with it.
Affected Products
- Google Chrome versions prior to 153.0.8010.36 (Stable Desktop channel)
- Chromium-based browsers that incorporate the vulnerable DOM code path
- Downstream Chromium distributions pending backport of the upstream fix
Discovery Timeline
- 2026-09-09 - CVE-2026-87631 published to NVD
- 2026-09-09 - Last updated in NVD database
- 2026-09 - Google releases Stable channel update for Desktop containing the fix (Chrome Releases)
Technical Details for CVE-2026-87631
Vulnerability Analysis
The issue resides in DOM handling within Blink, Chrome's rendering engine. An authorization check that should gate access to sensitive DOM-exposed data is absent, permitting a remote origin to observe information it is not entitled to read. Exploitation requires user interaction, typically loading an attacker-controlled HTML page. Because the network is the attack vector and no privileges are required, an attacker only needs to entice a victim to visit a malicious URL or view an attacker-controlled advertisement or iframe. Successful exploitation impacts confidentiality without altering integrity or availability of the browser session. Additional technical context is tracked in Chromium Issue Tracker #537476242.
Root Cause
The root cause is a missing authorization check [CWE-862] in a DOM interface. Access control logic that should validate the requesting origin or context before returning sensitive properties or state is not enforced. As a result, cross-origin or otherwise restricted content can query DOM state that leaks user-identifying or session-related information.
Attack Vector
An attacker hosts a crafted HTML page and lures a victim to open it in a vulnerable Chrome build. The page executes JavaScript that invokes the affected DOM APIs. Because the authorization check is missing, the browser returns data that should have been isolated to a different origin or privileged context. The attacker can then exfiltrate that data over the network to a controlled endpoint.
No verified proof-of-concept has been published. See the Chromium Issue Tracker entry and the Google Chrome Stable Update advisory for further technical detail.
Detection Methods for CVE-2026-87631
Indicators of Compromise
- Outbound HTTP or WebSocket connections from browser processes to unfamiliar domains immediately after page loads containing scripted DOM queries
- Chrome browser processes with version strings older than 153.0.8010.36 observed across managed endpoints
- Web proxy or DNS logs showing repeated visits to newly registered domains serving obfuscated JavaScript that touches DOM interfaces
Detection Strategies
- Inventory Chrome versions across the fleet and flag any instance below 153.0.8010.36 as vulnerable
- Correlate browser process telemetry with egress traffic to identify anomalous data exfiltration patterns following page navigation events
- Deploy content inspection rules on web gateways to identify scripts that repeatedly probe DOM properties associated with the affected interface
Monitoring Recommendations
- Track Chrome update compliance through endpoint management tooling and alert on stale versions
- Monitor browser telemetry for unusual JavaScript execution patterns originating from low-reputation or newly observed domains
- Review web proxy logs for HTML payloads that reference the DOM APIs cited in the Chromium issue tracker
How to Mitigate CVE-2026-87631
Immediate Actions Required
- Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints
- Restart browser sessions after patching to ensure the vulnerable Blink code is unloaded from memory
- Push the update to Chromium-based derivatives once vendors publish backported builds
Patch Information
Google addressed CVE-2026-87631 in the Stable channel update documented in the Google Chrome Stable Update advisory. Administrators managing Chrome through enterprise policy should verify the Chrome Update Component is enabled and confirm rollout via the browser's chrome://settings/help version indicator.
Workarounds
- Restrict browsing to trusted sites through enterprise web filtering until patches are deployed
- Enforce Site Isolation and disable third-party script execution on high-value user profiles where feasible
- Use browser management policies to block execution of scripts from newly registered or uncategorized domains
# Verify installed Chrome version on Linux endpoints
google-chrome --version
# Windows: query the installed version via registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version
# macOS: read the CFBundleShortVersionString
defaults read "/Applications/Google Chrome.app/Contents/Info" CFBundleShortVersionString
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.