CVE-2026-87644 Overview
CVE-2026-87644 is an incorrect authorization vulnerability [CWE-863] in the Views component of Google Chrome on Windows. The flaw affects Chrome versions prior to 153.0.8010.36. A remote attacker who has already compromised the renderer process can leverage social engineering and a crafted HTML page to potentially execute arbitrary code outside the Chrome sandbox. Google's Chromium security team rated this issue Medium severity, while the National Vulnerability Database assigned a higher CVSS base score due to scope change and full impact on confidentiality, integrity, and availability. The vulnerability enables a sandbox escape, which undermines one of Chrome's core defense-in-depth boundaries on Windows endpoints.
Critical Impact
Successful exploitation allows arbitrary code execution outside the Chrome sandbox on Windows hosts, granting attackers access to the underlying operating system with the privileges of the browser process.
Affected Products
- Google Chrome for Windows prior to version 153.0.8010.36
- Microsoft Windows platforms running vulnerable Chrome builds
- Chromium-based browsers that inherit the affected Views implementation
Discovery Timeline
- 2026-09-09 - CVE-2026-87644 published to NVD
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-87644
Vulnerability Analysis
The vulnerability resides in the Views UI framework used by Chrome on Windows. Views handles window management, widgets, and user interface events across the browser process. Incorrect authorization logic in this component allows a compromised renderer to trigger UI-mediated actions that should require higher privilege checks. When combined with user interaction driven by social engineering, the attacker can pivot from the sandboxed renderer into the browser process context. This effectively bypasses the site isolation and sandbox boundary that Chrome relies on to contain malicious web content. The result is arbitrary code execution on the underlying Windows host.
Root Cause
The root cause is an authorization check failure [CWE-863] in the Views component. Requests originating from the renderer are not properly validated against the privilege required to perform a UI action. The trust boundary between the sandboxed renderer and the browser process is enforced incorrectly, allowing crafted messages to reach code paths that assume caller legitimacy.
Attack Vector
Exploitation requires two prerequisites. First, the attacker must already control the renderer process, typically through a separate memory corruption or logic bug. Second, the victim must interact with a crafted HTML page in a way induced by social engineering. Once both conditions are met, the attacker chains the authorization flaw to execute code outside the sandbox. The attack complexity is high because of these preconditions, but the impact upon success is full compromise of the browser process context.
No public proof-of-concept code is available. Refer to the Chromium Issue Tracker #521616899 for restricted technical details and the Chrome Releases Update for the vendor advisory.
Detection Methods for CVE-2026-87644
Indicators of Compromise
- Chrome browser processes on Windows spawning unexpected child processes such as cmd.exe, powershell.exe, or rundll32.exe
- Unusual file writes or process creation originating from chrome.exe outside the standard update and cache paths
- Outbound network connections from renderer or browser processes to previously unseen infrastructure following user interaction with untrusted pages
Detection Strategies
- Inventory Chrome versions across Windows endpoints and flag any build older than 153.0.8010.36
- Monitor for renderer process anomalies including unexpected inter-process communication patterns and privilege transitions
- Correlate browser process activity with subsequent execution of scripting interpreters or living-off-the-land binaries
Monitoring Recommendations
- Enable process lineage telemetry for all Chromium-based browsers on Windows and forward events to a centralized analytics platform
- Alert on Chrome browser process behavior that deviates from baseline, such as writing to %APPDATA% outside profile directories
- Track Google Chrome update compliance as a continuous control rather than a point-in-time check
How to Mitigate CVE-2026-87644
Immediate Actions Required
- Update Google Chrome on all Windows endpoints to version 153.0.8010.36 or later
- Verify enterprise update channels and group policies are not blocking automatic Chrome updates
- Restart browser sessions after patch deployment to ensure the vulnerable Views code is unloaded
Patch Information
Google addressed CVE-2026-87644 in Chrome stable channel version 153.0.8010.36 for Windows. Details are published in the Chrome Releases Update. Chromium-based browser vendors such as Microsoft Edge, Brave, and Opera typically ship corresponding updates within days of the upstream Chromium release. Confirm each browser vendor's advisory and patch level independently.
Workarounds
- Enforce user awareness training focused on avoiding interaction with untrusted browser prompts and crafted pages, since exploitation requires social engineering
- Apply application control policies that restrict child process creation from chrome.exe on Windows endpoints
- Restrict browsing to trusted sites through enterprise web filtering until patches are fully deployed
# Verify installed Chrome version on Windows via PowerShell
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion
# Force Chrome update check via the Google Update client
& "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ua /installsource scheduler
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
