CVE-2026-87656: Google Chrome Auth Bypass Vulnerability

CVE-2026-87656 Overview

CVE-2026-87656 is an improper state validation vulnerability in the Safebrowsing component of Google Chrome. The flaw affects versions prior to 153.0.8010.36 and allows a remote attacker to bypass system access restrictions through a crafted HTML page. Chromium classifies the internal security severity as Low, while NVD assigns a medium rating based on the CVSS 3.1 metrics. Exploitation requires user interaction, such as visiting a malicious page, and can lead to limited compromise of confidentiality and integrity. The vulnerability maps to CWE-754: Improper Check for Unusual or Exceptional Conditions.

Critical Impact
A remote attacker can bypass Safebrowsing-enforced access restrictions by luring a user to a crafted HTML page, enabling limited access to protected browser state.

Affected Products

Google Chrome Desktop (Stable channel) prior to 153.0.8010.36
Chromium-based browsers embedding vulnerable Safebrowsing logic
Downstream distributions shipping Chrome versions earlier than 153.0.8010.36

Discovery Timeline

2026-09-09 - CVE-2026-87656 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87656

Vulnerability Analysis

The vulnerability resides in Chrome's Safebrowsing subsystem, which is responsible for evaluating navigation and content against known threat signals before permitting sensitive operations. Improper validation of internal state allows a specially crafted HTML page to reach code paths that should be gated by Safebrowsing checks. The result is a bypass of system access restrictions the browser normally enforces on untrusted web content. Exploitation is remote and requires the victim to load attacker-controlled content, satisfying the user interaction requirement in the CVSS vector.

Root Cause

The root cause is a state-validation defect classified under CWE-754. Safebrowsing does not correctly verify the expected operational state before honoring requests originating from a rendered HTML document. Under specific sequences, the component treats an unvalidated or transitional state as authorized, which permits actions that should have been denied. This pattern is characteristic of missing exceptional-condition checks in security-decision code.

Attack Vector

An attacker hosts a crafted HTML page and induces a user to visit it, for example through phishing, malvertising, or a compromised site. When Chrome processes the page, the malformed sequence triggers the state-validation flaw and bypasses Safebrowsing restrictions. The impact is limited to partial confidentiality and integrity loss with no availability impact. Additional technical detail is tracked in the Chromium Issue Tracker Entry.

No verified proof-of-concept or exploit code is publicly available for this issue. The vulnerability mechanism is described in prose; see the Google Chrome Update Notification for vendor guidance.

Detection Methods for CVE-2026-87656

Indicators of Compromise

Chrome browser processes running versions below 153.0.8010.36 after the patch release date.
Navigation logs showing users visiting unfamiliar or newly registered domains delivering HTML payloads that trigger Safebrowsing interstitial anomalies.
Endpoint telemetry indicating Chrome performing sensitive operations without a preceding Safebrowsing verdict event.

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build older than 153.0.8010.36.
Correlate browser process telemetry with proxy or DNS logs to identify sessions that loaded suspicious HTML content followed by unusual browser behavior.
Monitor for user reports of missing Safebrowsing warnings on known-malicious URLs, which can indicate bypass activity.

Monitoring Recommendations

Ingest Chrome enterprise reporting events, including browserVersion and Safebrowsing interstitial events, into centralized logging.
Track outbound web traffic to newly observed domains and correlate with browser version data to prioritize unpatched hosts.
Alert on Chrome update failures and delayed rollout of the 153.0.8010.36 build across the fleet.

How to Mitigate CVE-2026-87656

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all Windows, macOS, and Linux endpoints.
Force a browser restart after update deployment so the patched Safebrowsing code is loaded.
Verify enterprise Chrome auto-update policies are enabled and reachable from managed endpoints.

Patch Information

Google addressed CVE-2026-87656 in the Chrome Stable channel release 153.0.8010.36. Details of the release are published in the Google Chrome Update Notification. Administrators managing Chromium-derived browsers should confirm the vendor has merged the corresponding upstream fix.

Workarounds

Restrict user browsing to trusted sites via web proxy or DNS filtering until patches are fully deployed.
Enforce Safebrowsing Enhanced Protection through Chrome enterprise policy to increase defense-in-depth against crafted pages.
Deliver targeted user awareness reminding staff not to open unsolicited links, given that exploitation requires user interaction.

bash

# Configuration example: verify Chrome version on Linux endpoints
google-chrome --version

# Windows: query installed Chrome version from the registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version