CVE-2026-87649: Google Chrome Auth Bypass Vulnerability

CVE-2026-87649 Overview

CVE-2026-87649 is a user interface (UI) misrepresentation vulnerability in the Downloads component of Google Chrome prior to version 153.0.8010.36. A remote attacker can leverage social engineering combined with a crafted HTML page to bypass system access restrictions. The flaw is tracked under CWE-451: User Interface (UI) Misrepresentation of Critical Information and is rated Medium severity by the Chromium project. Successful exploitation requires user interaction, such as clicking a download prompt that misrepresents its true origin or intent.

Critical Impact
Attackers can trick users into accepting downloads that bypass Chrome's system access restriction warnings, enabling delivery of unwanted or malicious files.

Affected Products

Google Chrome Desktop (Stable channel) prior to 153.0.8010.36
Chromium-based browsers inheriting the affected Downloads code
Windows, macOS, and Linux builds of Google Chrome

Discovery Timeline

2026-09-09 - CVE-2026-87649 published to the National Vulnerability Database (NVD)
2026-09-10 - Last updated in NVD database
Stable Channel Update - Google issues fix in Chrome 153.0.8010.36 via the Google Chrome Stable Update advisory

Technical Details for CVE-2026-87649

Vulnerability Analysis

The vulnerability resides in the Chrome Downloads user interface. Chrome normally presents warnings when a download originates from a source that requires additional trust or when the file type triggers system access restrictions. This flaw allows a crafted HTML page to present the download prompt in a misleading manner. Users are induced to approve downloads under a false context, effectively bypassing safeguards that would otherwise gate access to protected system resources.

Because the flaw depends on visual deception rather than a memory-safety error, it does not directly grant code execution. Instead, it lowers the barrier for follow-on payload delivery and social-engineering-driven compromise. The scope is unchanged, and confidentiality and integrity impacts are limited.

Root Cause

The root cause is inadequate representation of trust context in the Downloads UI. According to the Chromium Issue Tracker Entry, the rendering path for download prompts does not sufficiently distinguish attacker-controlled content from legitimate browser-issued warnings. This aligns with the [CWE-451] classification, where security-relevant information is not conveyed accurately to the user.

Attack Vector

An attacker hosts a crafted HTML page and lures the victim through phishing, malvertising, or a compromised site. When the victim visits the page, JavaScript or HTML content manipulates the download interaction so that Chrome's system access restriction dialog is misrepresented. If the user approves the prompt, the attacker gains the ability to deliver files that would otherwise be blocked or warned against. The attack requires user interaction and network reachability to the malicious page.

No verified public proof-of-concept code is available. Refer to the Chromium Issue Tracker Entry for further technical context once access restrictions are lifted.

Detection Methods for CVE-2026-87649

Indicators of Compromise

Chrome browser processes with version strings below 153.0.8010.36 observed downloading executables or scripts from newly registered or low-reputation domains.
Download entries in Chrome history (History SQLite database) referencing HTML pages that immediately trigger file downloads following a single user click.
Endpoint file-write events for downloaded payloads originating from chrome.exe shortly after navigation to attacker-controlled URLs.

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any endpoint running a build older than 153.0.8010.36.
Correlate web proxy logs with endpoint download telemetry to identify HTML pages that induce downloads via scripted interaction.
Hunt for anomalous parent-child process relationships where chrome.exe writes executable file types (.exe, .msi, .dll, .lnk, .js, .hta) to user-writable paths.

Monitoring Recommendations

Enable browser telemetry forwarding to a centralized logging platform and monitor download events with URL, referrer, and file hash context.
Alert on downloads of high-risk file extensions from domains with low prevalence or short registration age.
Track user-reported phishing incidents involving download prompts and pivot on associated URLs and file hashes.

How to Mitigate CVE-2026-87649

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints.
Force a browser restart to ensure the patched binary is loaded, since Chrome applies updates on relaunch.
Audit Chromium-based browsers (Edge, Brave, Opera, Vivaldi) and apply upstream fixes as vendors release them.

Patch Information

Google addressed CVE-2026-87649 in the Chrome Stable channel release 153.0.8010.36. Consult the Google Chrome Stable Update advisory for the full release notes and rollout status. Enterprise administrators should deploy the update through Chrome Browser Enterprise policies or their standard software distribution mechanism.

Workarounds

Enforce Chrome's DownloadRestrictions enterprise policy to block dangerous file types until patches are deployed.
Deliver user awareness guidance instructing employees to reject unexpected download prompts and verify file origin.
Restrict browsing to categorized, reputable sites via web proxy or Secure Web Gateway to reduce exposure to malicious HTML pages.

bash

# Configuration example: Chrome enterprise policy to restrict downloads
# Windows registry path
HKLM\Software\Policies\Google\Chrome\DownloadRestrictions = 3

# macOS/Linux JSON policy
{
  "DownloadRestrictions": 3
}
# Value 3 = block all potentially dangerous downloads