CVE-2026-87429 in Chrome
Summary
by MITRE • 09/09/2026
Missing authorization in ServiceWorker in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as missing authorization within the ServiceWorker API in Google Chrome prior to version 153.0.8010.36 represents a critical failure in process isolation and privilege management. This flaw specifically impacts scenarios where an attacker has already achieved code execution or arbitrary script injection within a renderer process, which is typically considered a lower-privilege environment compared to the browser's main utility processes. The ServiceWorker API allows web applications to run scripts in the background, independent of web pages, facilitating features like offline access and push notifications. However, this power comes with significant security implications regarding resource access and network requests. In the affected versions, the implementation failed to properly enforce authorization checks when a compromised renderer process attempted to interact with ServiceWorker contexts or utilize their capabilities through crafted HTML payloads.
From a technical perspective, the core issue lies in the insufficient validation of permissions before allowing actions initiated by ServiceWorkers that are influenced or triggered by untrusted content within a sandboxed renderer. Normally, Chrome employs strict isolation boundaries between different processes and origins to prevent lateral movement from a compromised web page to more sensitive browser internals. When an attacker crafts an HTML page designed to exploit this gap, they can leverage the ServiceWorker's elevated privileges to perform actions that should be restricted by origin-based policies or user consent mechanisms. This bypass allows the malicious script to access system resources, make network requests on behalf of the service worker without proper authorization, or potentially exfiltrate sensitive data stored within the browser's storage mechanisms associated with those workers.
The operational impact of this vulnerability is significant for users who rely on web applications that utilize ServiceWorkers extensively, such as progressive web apps (PWAs) and complex single-page applications. Although the Chromium security severity was classified as Low, likely due to the prerequisite condition requiring renderer process compromise, the potential consequences remain severe in targeted attacks or when combined with other vulnerabilities like cross-site scripting flaws. An attacker could use this flaw to escalate privileges within the browser context, bypassing intended access controls and potentially gaining unauthorized visibility into user data that is protected by standard web security models. This undermines the trust model of the browser, where users expect that compromised websites cannot easily interact with background services or system-level features without explicit permission.
This vulnerability aligns closely with CWE-269, which describes Improper Privilege Management, specifically in contexts where a process fails to verify its own authority before performing an action. It also relates to ATT&CK technique T1053, Scheduled Task/Job, as ServiceWorkers can be seen as background tasks that persist beyond the life of a specific tab or window, and potentially T1218, Signed Binary Proxy Execution if the service worker is used to load additional scripts from untrusted sources. The lack of proper authorization checks allows an attacker to abuse these persistent execution contexts for malicious purposes, effectively turning legitimate browser features into vectors for persistence and data theft.
Mitigation strategies primarily involve updating Google Chrome to version 153.0.8010.36 or later, where the authorization logic within the ServiceWorker implementation has been corrected to enforce strict permission checks regardless of the initiating context's origin. For organizations unable to update immediately due to compatibility concerns, implementing Content Security Policy (CSP) headers can help mitigate some risks by restricting script sources and preventing unauthorized execution contexts. Additionally, users should be advised to disable unnecessary service workers for untrusted sites through browser settings or extensions that manage background permissions. Regular security audits of web applications using ServiceWorkers are recommended to ensure they do not inadvertently expose sensitive data or functionality through improper handling of worker lifecycle events and message passing mechanisms.