CVE-2026-87447 in Chrome
Summary
by MITRE • 09/09/2026
Incorrect authorization in Network in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: High)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as an incorrect authorization issue within the network subsystem of Google Chrome prior to version 153.0.8010.36 represents a significant breach in browser-based isolation mechanisms. This flaw specifically impacts the enforcement of web origin policies, which are fundamental security constructs designed to restrict how documents or scripts loaded from one origin can interact with resources from another origin. The core technical deficiency lies in the improper validation of authorization states when handling network requests initiated by Chrome extensions. In a properly secured environment, an extension should be strictly bound to its declared permissions and origins, preventing it from accessing data or performing actions on behalf of other sites without explicit user consent or proper API calls that respect cross-origin resource sharing rules. However, the identified flaw allows a maliciously crafted extension to circumvent these restrictions, effectively granting the extension elevated privileges beyond what was intended by the browser's security model.
The operational impact of this vulnerability is severe due to its reliance on social engineering for exploitation. A remote attacker does not need to exploit a zero-day code execution bug in the browser engine itself but rather manipulates user behavior. By distributing or promoting a malicious Chrome extension that appears legitimate, an attacker can trick users into installing it. Once installed, the extension leverages the authorization flaw to bypass web origin policies. This allows the compromised extension to read sensitive data from other websites visited by the user, such as session cookies, personal information, or financial details, and potentially exfiltrate this data to a remote server controlled by the attacker. The ability to bypass these isolation boundaries undermines the trust model of the browser, enabling cross-site scripting-like attacks through extensions rather than web pages directly.
From a classification perspective, this vulnerability aligns with CWE-269, which denotes Improper Privilege Assignment, as it involves an entity obtaining access or capabilities beyond its authorized level. It also relates to CWE-862, Missing Authorization, where the software does not perform necessary checks before allowing actions on behalf of users. In terms of offensive security frameworks like MITRE ATT&CK, this behavior is consistent with techniques involving browser extension abuse for data exfiltration and privilege escalation within the client environment. The attack vector falls under social engineering, specifically lure delivery via malicious extensions, which exploits human psychology rather than technical weaknesses in the underlying operating system or network stack directly.
Mitigation strategies primarily involve updating to Google Chrome version 153.0.8010.36 or later, where these authorization checks have been corrected and origin policies are strictly enforced for extension-generated requests. Users should exercise extreme caution when installing browser extensions, verifying the publisher's reputation and reviewing requested permissions before installation. Administrators in enterprise environments can enforce whitelisting of approved extensions to prevent unauthorized software from being installed. Additionally, monitoring network traffic generated by browser processes for anomalous cross-origin data transfers can help detect potential exploitation attempts in real-time. Regular security awareness training regarding social engineering tactics is also critical to reducing the likelihood of users falling victim to malicious extension distribution campaigns.