CVE-2026-87641: Google Chrome Race Condition Vulnerability

CVE-2026-87641 Overview

CVE-2026-87641 is a race condition vulnerability in the Browser component of Google Chrome versions prior to 153.0.8010.36. A remote attacker can bypass system access restrictions by serving a crafted HTML page to a targeted user. The Chromium project classifies the security severity as Medium. The flaw is tracked under CWE-362, covering concurrent execution using shared resources with improper synchronization. Successful exploitation requires user interaction, such as visiting a malicious page. Google addressed the issue in the Chrome Stable channel update released in September 2026.

Critical Impact
Remote attackers can bypass browser system access restrictions through a crafted HTML page, leading to limited confidentiality and integrity impact on the affected system.

Affected Products

Google Chrome versions prior to 153.0.8010.36
Chromium-based browsers sharing the vulnerable Browser component
Desktop distributions of Chrome on Windows, macOS, and Linux

Discovery Timeline

2026-09-09 - CVE-2026-87641 published to the National Vulnerability Database
2026-09-10 - Last updated in the NVD database
September 2026 - Google releases fixed version 153.0.8010.36 via the Chrome Stable Channel Update

Technical Details for CVE-2026-87641

Vulnerability Analysis

The vulnerability resides in the Chrome Browser process and stems from improper synchronization between concurrent execution paths. An attacker can exploit the timing window to bypass system access restrictions enforced by the browser. Because the flaw lives in the privileged Browser process rather than a sandboxed renderer, a successful race can subvert checks that normally gate access to system-level resources.

Exploitation requires the target user to load an attacker-controlled HTML page. The attack complexity is high because winning the race depends on precise timing conditions in the victim's browser. Attackers typically pair such races with additional primitives to achieve meaningful impact. Chromium tracks the underlying defect in Chromium Issue #523091391.

Root Cause

The root cause is a classic [CWE-362] race condition. Two or more code paths access shared state without adequate locking or atomic operations. When the operations interleave in a specific order, security checks that validate access to protected resources execute against stale or partially updated state. The Browser process then proceeds with an action that should have been denied.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker hosts a crafted HTML page and induces the victim to visit it through phishing, malvertising, or a compromised site. The page triggers concurrent browser operations designed to hit the vulnerable window. Winning the race allows the page to circumvent restrictions the Browser process normally enforces on web content.

No public proof-of-concept exploit is available for this issue at the time of publication, and it is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to Chromium Issue #523091391 for restricted technical details.

Detection Methods for CVE-2026-87641

Indicators of Compromise

Chrome processes at versions below 153.0.8010.36 observed in endpoint telemetry after the patch release date.
Browser navigation logs showing repeated visits to unfamiliar domains hosting HTML pages with heavy concurrent JavaScript workers or worklets.
Unexpected child processes, file writes, or IPC activity originating from the Chrome Browser process shortly after page load.

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag hosts running builds prior to 153.0.8010.36.
Correlate outbound web traffic with process lineage to identify browser sessions that spawn anomalous system interactions after visiting external HTML content.
Monitor for exploitation chains that combine this race condition with sandbox escapes or privilege escalation attempts on the same host.

Monitoring Recommendations

Ingest browser update status and endpoint version telemetry into a centralized data lake for continuous compliance reporting.
Alert on Chrome processes performing file system or registry operations that fall outside baseline user browsing behavior.
Track web proxy and DNS logs for connections to newly registered domains delivering suspicious HTML payloads to internal users.

How to Mitigate CVE-2026-87641

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints without delay.
Enforce automatic browser updates through enterprise policy to reduce exposure windows for future Chromium fixes.
Restart Chrome after the update installs to ensure the patched Browser process replaces vulnerable instances.

Patch Information

Google released the fix in the Chrome Stable Channel update announced in the Chrome Stable Update - September 2026 advisory. Administrators should validate deployment by checking chrome://version on representative endpoints and confirming the build number is 153.0.8010.36 or higher. Chromium-derived browsers such as Microsoft Edge, Brave, Opera, and Vivaldi should be updated once their vendors ship builds incorporating the upstream fix.

Workarounds

Restrict browsing to trusted sites via enterprise URL filtering until patch deployment completes.
Deploy web content filtering and DNS security controls to block known malicious or newly registered domains.
Educate users about phishing lures that direct them to unfamiliar HTML pages, which are the primary delivery vector.

bash

# Verify Chrome version on Linux endpoints
google-chrome --version

# Windows: query installed version via registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# macOS: check installed Chrome build
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString