CVE-2026-87658: Google Chrome Extension Information Leak

CVE-2026-87658 Overview

CVE-2026-87658 is an information disclosure vulnerability in the Extensions component of Google Chrome. A remote attacker can leverage social engineering to trick a user into installing a crafted Chrome extension. The malicious extension can then obtain cross-origin data that would normally be protected by Chrome's same-origin policy.

Google addressed the issue in Chrome 153.0.8010.36 on the Stable channel. The flaw is tracked under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Google rated the underlying Chromium issue as Medium severity.

Critical Impact
A crafted Chrome extension can exfiltrate data belonging to other origins, breaking web isolation guarantees and exposing session content, form data, or other cross-origin resources.

Affected Products

Google Chrome Stable channel prior to 153.0.8010.36
Chromium-based desktop browsers built on affected upstream versions
Managed Chrome deployments that have not yet received the Stable channel update

Discovery Timeline

2026-09-09 - CVE-2026-87658 published to the National Vulnerability Database
2026-09-09 - Google Chrome Stable channel update released addressing the issue
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87658

Vulnerability Analysis

The vulnerability resides in Chrome's Extensions subsystem. Extensions receive elevated privileges relative to normal web pages, including the ability to interact with multiple origins through content scripts and privileged APIs. A logic flaw in this trust boundary allows a crafted extension to read data from origins it should not be able to access.

The root failure is a cross-origin isolation bypass. Data that should be partitioned per-origin becomes reachable through the extension surface. This corresponds to [CWE-200: Information Exposure], where a component discloses information to an actor outside the intended sphere of control.

Exploitation requires user interaction. The attacker must convince the target to install the malicious extension, typically through phishing pages, deceptive marketplaces, or bundled installers.

Root Cause

The root cause is improper enforcement of same-origin restrictions within Extensions APIs. The component fails to validate that a request initiated by an extension is authorized to access the target origin's data. Full technical detail is restricted in the Chromium Issue Tracker entry 496615345 pending broad patch adoption.

Attack Vector

The attack vector is network-based but requires user interaction. An attacker publishes or distributes a crafted extension and uses social engineering to drive installation. Once installed, the extension issues requests or invokes APIs that trigger the flaw and returns cross-origin content to attacker-controlled infrastructure.

No verified proof-of-concept code is publicly available. Refer to the Google Chrome Stable channel update for the vendor advisory.

Detection Methods for CVE-2026-87658

Indicators of Compromise

Chrome browser versions prior to 153.0.8010.36 running on managed endpoints
Recently installed extensions sourced from outside the Chrome Web Store or from low-reputation publishers
Extensions requesting broad host permissions such as <all_urls> combined with outbound connections to unfamiliar domains
Unexpected outbound HTTPS traffic from chrome.exe correlated with extension installation events

Detection Strategies

Inventory installed Chrome extensions across the fleet and compare extension IDs against an approved allowlist
Correlate browser version telemetry with the fixed version 153.0.8010.36 to identify unpatched hosts
Alert on new extension installations that request sensitive permissions, especially outside enterprise-managed policy
Monitor for anomalous data transfer volumes originating from browser processes after extension installation

Monitoring Recommendations

Ingest browser and endpoint telemetry into a centralized data lake for cross-source correlation of extension activity
Enable Chrome Enterprise reporting to forward extension install, update, and permission events to the SIEM
Track EPSS movement for CVE-2026-87658; current EPSS is 0.18% at the 7.6 percentile, indicating low near-term exploitation likelihood
Review DNS and proxy logs for extension-initiated connections to newly registered or uncategorized domains

How to Mitigate CVE-2026-87658

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all Windows, macOS, and Linux endpoints
Restart Chrome after the update completes to ensure the patched binary is active
Audit installed extensions and remove any that are unnecessary, unmanaged, or sourced from untrusted publishers
Communicate to users the risk of installing extensions in response to unsolicited prompts or third-party instructions

Patch Information

Google released the fix in the Chrome Stable channel update documented in the Google Chrome Stable channel update. The fixed version is 153.0.8010.36. Chromium-based browser vendors should pick up the corresponding upstream patch and issue downstream releases.

Workarounds

Enforce an extension allowlist through Chrome Enterprise policy (ExtensionInstallAllowlist) and block all others with ExtensionInstallBlocklist
Restrict extension installation sources to the Chrome Web Store using ExtensionInstallSources
Require administrator approval for new extension installations in managed environments
Educate users on social engineering tactics used to distribute malicious extensions

bash

# Chrome Enterprise policy example (Windows registry, HKLM)
# Allow only vetted extensions and block everything else
reg add "HKLM\Software\Policies\Google\Chrome\ExtensionInstallBlocklist" /v 1 /t REG_SZ /d "*" /f
reg add "HKLM\Software\Policies\Google\Chrome\ExtensionInstallAllowlist" /v 1 /t REG_SZ /d "<approved-extension-id>" /f

# Force update Chrome to the patched version via managed policy
reg add "HKLM\Software\Policies\Google\Update" /v UpdateDefault /t REG_DWORD /d 1 /f