CVE-2026-87645: Google Chrome Auth Bypass Vulnerability

CVE-2026-87645 Overview

CVE-2026-87645 is an improper state validation flaw in the Safe Browsing component of Google Chrome versions prior to 153.0.8010.36. A remote attacker can bypass system access restrictions by serving a crafted HTML page to a targeted user. The Chromium project rates the security severity as Medium, and exploitation requires user interaction such as visiting a malicious page. The weakness is categorized as [CWE-754: Improper Check for Unusual or Exceptional Conditions]. No public exploit code or in-the-wild abuse has been reported at the time of publication.

Critical Impact
A remote attacker can bypass Safe Browsing state checks through a crafted HTML page, weakening protections against malicious content and system access restrictions.

Affected Products

Google Chrome for Desktop versions prior to 153.0.8010.36
Chromium-based browsers that inherit the vulnerable Safe Browsing state validation logic
All supported desktop platforms (Windows, macOS, Linux) running affected Chrome builds

Discovery Timeline

2026-09-09 - CVE-2026-87645 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87645

Vulnerability Analysis

The flaw resides in Chrome's Safe Browsing subsystem, which is responsible for evaluating the reputation and safety posture of URLs, downloads, and page resources. Safe Browsing enforces state checks that gate access to sensitive browser capabilities. When those checks fail to validate state correctly, protections that normally block or warn about hostile content can be bypassed.

An attacker leverages the issue by luring a user to a crafted HTML page. The page manipulates the sequence or context of Safe Browsing state transitions so that access restrictions the browser would otherwise enforce are not applied. The result is limited but real exposure of confidentiality and integrity, without any impact on availability.

Root Cause

The underlying weakness is [CWE-754], improper check for unusual or exceptional conditions. Safe Browsing code paths do not adequately validate an intermediate state before permitting an operation, so an attacker can drive the browser into a condition where the expected guard is skipped. See the Chromium Issue Tracker #502611474 for restricted technical detail.

Attack Vector

Exploitation is network-based and requires user interaction. The victim must load attacker-controlled HTML, for example by clicking a link, opening a redirect, or rendering a malicious frame embedded in a compromised site. No authentication is required, and the attack does not need elevated privileges on the target system.

No verified proof-of-concept has been published. Refer to the Google Chrome Stable Update advisory for vendor-authoritative details.

Detection Methods for CVE-2026-87645

Indicators of Compromise

Endpoints running Chrome builds earlier than 153.0.8010.36 after the patch release date
Browser telemetry showing navigation to unfamiliar domains immediately preceding unexpected downloads or permission grants
Absence of expected Safe Browsing warning interstitials on known-malicious URLs during user browsing sessions

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any host below 153.0.8010.36 as vulnerable
Correlate web proxy logs with threat intelligence feeds to surface user visits to pages known to abuse Safe Browsing bypasses
Monitor for anomalous child-process activity spawned from chrome.exe following navigation events

Monitoring Recommendations

Ingest Chrome update and version telemetry into the SIEM to track patch compliance over time
Alert on disabled or misconfigured Safe Browsing policies enforced through enterprise policy templates
Review DNS and TLS logs for repeat connections to newly registered domains hosting crafted HTML content

How to Mitigate CVE-2026-87645

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints
Force a browser relaunch after the update to ensure the patched binary is loaded into memory
Verify that Safe Browsing is enabled and enforced through enterprise policy across the environment

Patch Information

Google released the fix in the Stable channel update documented in the Google Chrome Stable Update advisory. Administrators should deploy Chrome 153.0.8010.36 or later. Chromium-based browsers such as Microsoft Edge, Brave, and Opera should be updated once their vendors ship builds that incorporate the upstream patch.

Workarounds

Restrict browsing to trusted sites through web filtering while patch deployment is in progress
Enforce Enhanced Safe Browsing via the SafeBrowsingProtectionLevel enterprise policy to raise the bar for bypass attempts
Educate users to avoid clicking untrusted links and to report unexpected browser behavior to the security team

bash

# Configuration example: enforce Enhanced Safe Browsing via Chrome enterprise policy (Linux example)
sudo mkdir -p /etc/opt/chrome/policies/managed
sudo tee /etc/opt/chrome/policies/managed/safebrowsing.json > /dev/null <<'EOF'
{
  "SafeBrowsingProtectionLevel": 2,
  "SafeBrowsingExtendedReportingEnabled": true,
  "ComponentUpdatesEnabled": true
}
EOF