CVE-2026-87652: Google Chrome Auth Bypass Vulnerability

CVE-2026-87652 Overview

CVE-2026-87652 is an incorrect authorization vulnerability [CWE-863] in the PushAPI implementation of Google Chrome. The flaw affects Chrome versions prior to 153.0.8010.36. A remote attacker who has already compromised the renderer process can bypass web origin policy by serving a crafted HTML page. Chromium security engineers rated the underlying issue Medium severity, while the NVD assigned a lower CVSS score based on the required attack conditions.

Critical Impact
Attackers with an existing renderer compromise can bypass same-origin restrictions in PushAPI, exposing push subscription data across origin boundaries.

Affected Products

Google Chrome versions prior to 153.0.8010.36
Chromium-based browsers embedding the affected PushAPI component
Desktop Chrome Stable channel on Windows, macOS, and Linux

Discovery Timeline

2026-09-09 - CVE-2026-87652 published to the National Vulnerability Database
2026-09-09 - Google published the Stable Channel Update for Desktop advisory
2026-09-09 - Last updated in the NVD database

Technical Details for CVE-2026-87652

Vulnerability Analysis

The vulnerability resides in Chrome's PushAPI, the browser interface that lets web applications receive server-sent push messages. PushAPI subscriptions and messages are bound to a specific web origin under the same-origin policy. Incorrect authorization logic in the affected component allows a compromised renderer to interact with push resources outside its permitted origin.

Exploitation requires two conditions. First, the attacker must already control a Chrome renderer process, typically achieved through a separate memory corruption or logic flaw. Second, the victim must load a crafted HTML page that triggers the flawed authorization path. The user interaction requirement and high attack complexity limit opportunistic exploitation.

The impact is limited to confidentiality of push-related data. It does not directly enable code execution, integrity loss, or availability impact. However, chained with a renderer exploit, it broadens the reach of a browser compromise across origins.

Root Cause

The root cause is a missing or insufficient authorization check [CWE-863] within the PushAPI code path. The component does not correctly verify that the calling renderer is entitled to act on push subscriptions belonging to a given origin. This gap breaks the security boundary that isolates web origins in the multi-process browser architecture.

Attack Vector

The attack is network-reachable and delivered through web content. An attacker hosts or injects a crafted HTML page that, once rendered by a compromised renderer, invokes the PushAPI in ways the authorization logic fails to reject. Because the renderer must already be compromised, the vulnerability is best modeled as a sandbox-scope or origin-scope expansion primitive rather than a standalone remote flaw.

No public proof-of-concept, exploit module, or evidence of in-the-wild exploitation is currently documented. The CISA Known Exploited Vulnerabilities catalog does not list this CVE.

Detection Methods for CVE-2026-87652

Indicators of Compromise

Chrome processes on endpoints reporting a version string below 153.0.8010.36 after the patch release window.
Unexpected outbound connections from browser processes to unfamiliar push service endpoints or attacker-controlled infrastructure.
Anomalous service worker registrations or push subscription events tied to origins the user did not intentionally visit.

Detection Strategies

Inventory installed browser versions across managed endpoints and flag Chrome builds older than 153.0.8010.36.
Correlate renderer process crashes or exploitation indicators with subsequent PushAPI or service worker activity that crosses origin boundaries.
Monitor browser telemetry and proxy logs for unusual push notification subscription patterns that do not match user browsing behavior.

Monitoring Recommendations

Ingest browser and endpoint telemetry into a centralized data lake to enable version-drift and behavioral analytics.
Alert on Chrome processes spawning unexpected child processes or performing unusual network activity after visiting untrusted sites.
Track advisories on the Chrome Releases blog to identify follow-on patches affecting the same component.

How to Mitigate CVE-2026-87652

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints.
Restart the browser after applying the update to ensure the patched binaries load.
Verify enterprise auto-update policies are enabled and not blocked by proxy or endpoint controls.

Patch Information

Google addressed the flaw in the Chrome Stable channel update documented in the Google Chrome Stable Update advisory. Technical tracking is available in Chromium Issue #499425100. Administrators managing Chromium-based derivatives should confirm downstream vendors have merged the fix.

Workarounds

Disable push notifications through enterprise policy where the feature is not required for business use.
Restrict browsing to trusted sites via web filtering while endpoints remain unpatched.
Enforce site isolation and the latest Chrome sandbox defaults to increase the cost of the prerequisite renderer compromise.

bash

# Configuration example: enterprise policy to disable push notifications
# Windows registry key for Chrome enterprise management
reg add "HKLM\Software\Policies\Google\Chrome" /v DefaultNotificationsSetting /t REG_DWORD /d 2 /f

# Verify installed Chrome version on Linux endpoints
google-chrome --version