CVE-2026-87431 in Chrome
Summary
by MITRE • 09/09/2026
Missing authorization in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted Chrome extension. (Chromium security severity: Medium)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as missing authorization within the extensions subsystem of Google Chrome, specifically in versions preceding 153.0.8010.36, represents a critical failure in access control mechanisms that governs how browser extensions interact with sensitive user data and system resources. This flaw stems from an insufficient validation of permissions when an extension attempts to access protected APIs or internal browser states. In the Chrome architecture, extensions operate within isolated contexts but are granted varying levels of privilege based on declared manifest permissions and runtime authorization checks. When these checks are bypassed or improperly implemented, it allows a maliciously crafted extension to execute actions that exceed its intended scope without triggering appropriate security warnings or denial responses. This type of defect is fundamentally categorized under CWE-269, which denotes Improper Privilege Management, as the application fails to enforce proper authorization policies for elevated functions accessed by less privileged entities.
From an operational perspective, this vulnerability enables a remote attacker to achieve unauthorized access to sensitive information stored within the browser environment. By crafting a malicious Chrome extension that exploits this missing authorization check, an adversary can trick a user into installing it through legitimate distribution channels or social engineering tactics. Once installed and activated, the extension can silently exfiltrate data such as browsing history, saved passwords, cookies containing session tokens, or other personally identifiable information without the user's knowledge or consent. The severity is rated as medium because while the impact involves significant privacy breaches and potential account compromise, it typically requires user interaction to install the malicious component, distinguishing it from purely remote code execution vulnerabilities that require no user action. However, given the pervasive nature of browser extensions in modern web workflows, even a medium-severity flaw can lead to widespread data leakage across large user bases if not promptly addressed.
The technical mechanism behind this exploit relies on the extension's ability to invoke internal Chrome APIs or access local storage areas that are supposed to be restricted to privileged contexts or require explicit user consent for each sensitive operation. The absence of a robust authorization gate means that once an extension is loaded, it can query these protected resources directly. This aligns with ATT&CK technique T1530, Data from Local System, where adversaries collect data from local file systems and databases accessible to the compromised process. Furthermore, since extensions often have broad access to web content via permissions like activeTab or host_permissions, this flaw amplifies the risk of cross-site scripting-like behaviors within the extension context itself, allowing for more sophisticated data harvesting than standard script injection attacks.
Mitigation strategies must focus on both immediate patching and long-term architectural improvements. The primary remediation is to upgrade Google Chrome to version 153.0.8010.36 or later, where the authorization checks have been reinforced to ensure that extensions cannot access sensitive data without proper validation of their declared permissions and runtime context. For organizations managing enterprise deployments, enforcing strict extension whitelisting policies through Group Policy can prevent the installation of unvetted third-party extensions, thereby reducing the attack surface. Additionally, developers should adhere to the principle of least privilege when designing browser add-ons, ensuring that only necessary permissions are requested and that all access to sensitive APIs is explicitly logged and audited. Regular security audits of extension codebases using static analysis tools can help identify similar authorization flaws before they reach production environments, thereby maintaining a higher baseline of security for end-users relying on the browser ecosystem.