CVE-2026-87632: Google Chrome XSS Vulnerability

CVE-2026-87632 Overview

CVE-2026-87632 is a cross-site scripting (XSS) vulnerability in the SanitizerAPI component of Google Chrome. Versions prior to 153.0.8010.36 allow a remote attacker to bypass web origin policy through a crafted HTML page. Chromium classifies the security severity as Medium. The flaw maps to [CWE-79], improper neutralization of input during web page generation.

Exploitation requires user interaction, such as visiting an attacker-controlled page. A successful attack can lead to script execution in the context of another origin, undermining the browser's same-origin protections. Google has addressed the issue in the Stable channel release for desktop.

Critical Impact
A remote attacker can bypass web origin policy via a crafted HTML page, enabling cross-site scripting against Chrome users who load malicious content.

Affected Products

Google Chrome desktop versions prior to 153.0.8010.36
Chromium-based browsers that consume the affected SanitizerAPI implementation
Downstream distributions that have not integrated the upstream Chromium fix

Discovery Timeline

2026-09-09 - CVE-2026-87632 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87632

Vulnerability Analysis

The vulnerability resides in Chrome's SanitizerAPI, the browser interface designed to safely sanitize untrusted HTML before insertion into the DOM. The sanitizer is expected to strip elements, attributes, and script content that could execute in a foreign origin. In vulnerable builds, a crafted HTML payload processed through the API can escape those controls and execute script content that violates the web origin policy.

The attack targets client-side trust boundaries rather than the browser process itself. Because the sanitizer is used by web applications specifically to render third-party or user-supplied content, a bypass allows malicious markup to reach the DOM in a state that browsers treat as trusted. Impact is limited to confidentiality within the affected origin, with no integrity or availability effect indicated by the Chromium severity rating.

Root Cause

The root cause is an incomplete sanitization routine in the SanitizerAPI implementation. Certain HTML constructs are not neutralized before returning sanitized output, allowing script-bearing markup to survive the sanitization pass and execute when inserted into a document.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker hosts a crafted HTML page, or injects crafted markup into a site that relies on SanitizerAPI for defense-in-depth. When a victim loads the content in a vulnerable Chrome build, the sanitizer emits markup that runs script in a context that bypasses origin controls. No authentication is required. See the Chromium Issue Tracker Entry for upstream detail once access restrictions are lifted.

Detection Methods for CVE-2026-87632

Indicators of Compromise

Chrome desktop clients reporting a version string earlier than 153.0.8010.36 in browser telemetry or chrome://version
Web application logs showing sanitized HTML output that still contains executable script constructs
Content Security Policy (CSP) violation reports referencing unexpected inline script execution on pages that use SanitizerAPI

Detection Strategies

Inventory browser versions across managed endpoints and flag any Chrome build below 153.0.8010.36
Correlate CSP violation reports with pages that render user-supplied HTML through the SanitizerAPI
Review web proxy logs for repeated visits to unfamiliar domains serving HTML that targets Chrome clients

Monitoring Recommendations

Enable browser version reporting through enterprise management tooling and alert on unpatched clients
Deploy strict CSP with a violation reporting endpoint to surface sanitizer bypass attempts
Monitor endpoint telemetry for anomalous script execution originating from browser renderer processes

How to Mitigate CVE-2026-87632

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all managed desktops
Force a browser restart to ensure the patched binary is loaded across user sessions
Verify Chromium-based derivative browsers have consumed the upstream fix before allowing them in production

Patch Information

Google released the fix in the Stable channel for desktop. Details are available in the Google Chrome Desktop Update advisory. Enterprises using managed update policies should confirm the target version is set to 153.0.8010.36 or later.

Workarounds

Enforce a strict Content Security Policy that disallows inline script execution on sensitive origins
Avoid relying solely on SanitizerAPI output for security-critical rendering until all clients are patched
Restrict access to untrusted web content through browser isolation or enterprise browsing policies

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Windows: query the installed version via registry
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# macOS: read the CFBundleShortVersionString
defaults read "/Applications/Google Chrome.app/Contents/Info.plist" CFBundleShortVersionString