CVE-2026-87651: Google Chrome Auth Bypass Vulnerability

CVE-2026-87651 Overview

CVE-2026-87651 is an incorrect authorization vulnerability in the Paint component of Google Chrome. The flaw affects versions prior to 153.0.8010.36 and allows a remote attacker to obtain cross-origin data through a crafted HTML page. Chromium engineers rated the internal security severity as High, while the NVD assigns a medium CVSS 3.1 score.

The vulnerability maps to [CWE-863: Incorrect Authorization]. Exploitation requires user interaction, typically visiting an attacker-controlled page. Successful exploitation breaks the same-origin policy and exposes confidential data from other web origins.

Critical Impact
A remote attacker can bypass browser origin isolation and read data belonging to other web origins, enabling theft of authenticated session content, private user data, and sensitive API responses.

Affected Products

Google Chrome desktop versions prior to 153.0.8010.36
Chromium-based browsers embedding the vulnerable Paint component
All operating systems supported by the Chrome Stable channel (Windows, macOS, Linux)

Discovery Timeline

2026-09-09 - CVE-2026-87651 published to NVD
2026-09-09 - Last updated in NVD database
2026-09 - Google releases Stable Channel update addressing the flaw (Google Chrome Stable Update)

Technical Details for CVE-2026-87651

Vulnerability Analysis

The vulnerability resides in Chrome's Paint component, which is responsible for rasterizing and rendering visual content across frames and origins. An authorization check in the paint pipeline fails to correctly enforce origin boundaries when handling specific cross-origin resources. As a result, a malicious page can coerce the renderer into exposing pixel data or derived information that belongs to another origin.

Attack complexity is low and no privileges are required, but the attacker must convince a user to load a crafted HTML page. The impact is limited to confidentiality; integrity and availability are not affected. Additional technical context is tracked in Chromium Issue Tracker #550141694.

Root Cause

The root cause is an improper authorization decision [CWE-863] inside the Paint subsystem. The affected code path evaluates access to a resource without correctly validating whether the requesting origin should be permitted to observe the pixel or graphics data. This weakens the same-origin policy that browsers rely on to isolate documents.

Attack Vector

Exploitation occurs over the network via a crafted HTML page. The attacker hosts malicious markup and script that instructs the renderer to paint or sample cross-origin content in an unexpected way. When the victim visits the page, the browser leaks cross-origin data back to the attacker's JavaScript context, where it can be exfiltrated to a remote server. No authentication is required on the victim side beyond an active browsing session with the targeted origins.

No public proof-of-concept exploit is available at the time of publication, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-87651

Indicators of Compromise

Chrome browser processes running versions earlier than 153.0.8010.36 on endpoints with internet access
Outbound requests from browser processes to newly registered or low-reputation domains immediately after page loads containing large volumes of canvas, image, or SVG elements
Unusual POST requests carrying base64-encoded or binary blobs originating from renderer processes shortly after navigation events

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any instance below 153.0.8010.36 as vulnerable
Correlate browser telemetry with network egress to identify pages that trigger cross-origin resource loads followed by suspicious outbound data transfers
Monitor for phishing lures and watering-hole pages that attempt to load authenticated third-party content inside iframes, canvases, or image tags

Monitoring Recommendations

Ingest browser process telemetry and DNS logs into a centralized data lake for retrospective hunting once indicators emerge
Alert on Chrome renderer processes making direct external network connections outside of expected update and telemetry endpoints
Track user navigation to newly seen domains and correlate with subsequent access to internal SaaS applications that hold sensitive data

How to Mitigate CVE-2026-87651

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints through the Stable channel
Restart Chrome after the update so the patched renderer and Paint components are loaded into memory
Audit any Chromium-based browsers and embedded WebView components in enterprise applications for the same underlying fix

Patch Information

Google addressed CVE-2026-87651 in Chrome Stable 153.0.8010.36. Details are published in the Google Chrome Stable Update release notes, and the underlying issue is tracked in Chromium Issue Tracker #550141694. Administrators using enterprise policy should verify that automatic updates are enabled and not blocked by proxy or firewall rules.

Workarounds

Enforce Chrome auto-update through group policy or MDM to close the exposure window across the fleet
Restrict browsing to trusted sites via URL allowlisting for high-risk user populations until patch coverage is confirmed
Educate users to avoid clicking links from untrusted sources, since exploitation requires loading a crafted HTML page

bash

# Verify installed Chrome version on Windows endpoints
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Verify installed Chrome version on macOS endpoints
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString

# Verify installed Chrome version on Linux endpoints
google-chrome --version