CVE-2026-87446 in Chrome
Summary
by MITRE • 09/09/2026
Incomplete cleanup in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as an incomplete cleanup issue within the extensions subsystem of Google Chrome prior to version 153.0.8010.36 represents a significant flaw in how the browser manages resources and permissions associated with third-party add-ons. This defect allows for a bypass of system access restrictions, effectively undermining the security boundaries that isolate web content from local operating system components. The core technical failure lies in the lifecycle management of extension processes or their associated data structures, where specific cleanup routines fail to execute completely upon uninstallation, closure, or privilege revocation. Consequently, residual state or lingering permissions may persist even after an extension is ostensibly removed or disabled by the user or administrator. This persistence creates a window of opportunity for malicious actors who have successfully installed a crafted Chrome extension through social engineering tactics. By exploiting this incomplete cleanup mechanism, an attacker can maintain access to sensitive browser APIs or system-level interfaces that should no longer be available, thereby achieving unauthorized access to data or functionality protected by standard security policies.
From a technical perspective, this vulnerability aligns with CWE-401, which describes the failure to release resources after their use is complete. In the context of modern web browsers like Chrome, extensions operate within a sandboxed environment designed to limit their impact on the host system and other tabs. However, when cleanup procedures are incomplete, these sandboxes can be effectively breached or bypassed through state leakage. The attacker leverages social engineering to trick users into installing malicious extensions that appear legitimate but contain code designed to exploit this specific race condition or logic error in resource deallocation. Once installed, the extension may perform actions such as reading cookies, accessing local storage, or interacting with native messaging hosts before being removed. Because the cleanup is incomplete, these interactions might leave behind artifacts or active sessions that allow subsequent exploitation even after the user believes they have mitigated the threat by uninstalling the extension. This persistence mechanism significantly increases the attack surface and duration of potential compromise.
The operational impact of this vulnerability extends beyond simple data theft to include persistent unauthorized access and potential lateral movement within a compromised environment. An attacker who successfully exploits this flaw can maintain a foothold in the victim's browser session, potentially exfiltrating sensitive information such as authentication tokens, personal identifiable information, or corporate credentials stored locally by web applications. Furthermore, if the extension had permissions to interact with native applications via Chrome Native Messaging API, the incomplete cleanup could allow continued communication between malicious code and local executables on the user’s machine. This capability transforms a browser-based vulnerability into a potential vector for broader system compromise. The severity is classified as medium because while it requires initial social engineering to gain entry, the resulting persistence and access bypass capabilities make it a serious threat to endpoint security integrity.
To mitigate this risk, organizations must ensure that all instances of Google Chrome are updated to version 153.0.8010.36 or later, where these cleanup routines have been corrected. In environments where automatic updates cannot be immediately deployed, strict application control policies should be enforced to prevent the installation of unauthorized extensions from untrusted sources. Security teams should also monitor for unusual browser behavior indicative of persistent extension activity, such as unexpected network connections or file system access by Chrome processes after known malicious extensions were supposedly removed. Additionally, user awareness training is critical to reduce the success rate of social engineering attacks that serve as the initial vector for this vulnerability. By combining timely patching with robust policy enforcement and user education, organizations can effectively neutralize the threat posed by incomplete cleanup vulnerabilities in browser extension architectures. This approach aligns with MITRE ATT&CK techniques related to persistence via browser extensions and privilege escalation through resource manipulation, ensuring a comprehensive defense strategy against such sophisticated attacks.