CVE-2026-87449 in Chrome
Summary
by MITRE • 09/09/2026
Cross-site request forgery in DeviceBoundSessionCredentials in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as Cross-site request forgery within the DeviceBoundSessionCredentials component of Google Chrome prior to version 153.0.8010.36 represents a significant deviation from expected web origin policy enforcement mechanisms. This flaw specifically affects how credentials bound to specific devices are handled during cross-origin requests, allowing an attacker to exploit the browser's trust in these session tokens for unauthorized actions. The core technical issue lies in the insufficient validation of request origins when utilizing device-bound authentication contexts. Typically, modern browsers enforce strict same-origin policies to prevent malicious sites from reading or manipulating data belonging to other domains. However, in this specific implementation, the credential binding mechanism failed to adequately restrict usage based on the requesting origin, effectively creating a window where forged requests could be authenticated and executed as if they originated from legitimate sources.
From an operational perspective, this vulnerability allows a remote attacker to craft a malicious HTML page that, when visited by a victim with active DeviceBoundSessionCredentials, triggers unauthorized API calls or state-changing actions on behalf of the user. The impact is particularly severe because device-bound credentials often carry higher privileges than standard session cookies, as they are tied to specific hardware identifiers and may be used for sensitive administrative tasks or secure communications. An attacker leveraging this flaw could potentially perform account takeover operations, exfiltrate sensitive data protected by these elevated credentials, or manipulate application states in ways that compromise user privacy and system integrity. The medium severity rating assigned by the Chromium security team reflects the potential for significant harm while acknowledging that exploitation requires specific conditions, such as the victim having active device-bound sessions and visiting a crafted page without immediate detection mechanisms.
This vulnerability aligns closely with CWE-352, which describes Cross-Site Request Forgery (CSRF), specifically highlighting failures in verifying the origin of requests when sensitive credentials are involved. Furthermore, it maps to MITRE ATT&CK technique T1078, Valid Accounts, as the attacker leverages legitimate but improperly validated session tokens to gain unauthorized access or perform actions under a trusted identity. The exploitation vector typically involves social engineering tactics where users are directed to malicious websites that contain hidden forms or scripts designed to submit requests to vulnerable endpoints protected only by these device-bound credentials.
Mitigation strategies primarily involve updating the browser to version 153.0.8010.36 or later, which addresses the underlying logic errors in how DeviceBoundSessionCredentials are validated against request origins. For organizations relying on Chrome for enterprise environments, it is critical to ensure rapid deployment of these patches across all endpoints to close this security gap. Additionally, developers and administrators should review applications that utilize device-bound authentication mechanisms to implement additional layers of defense, such as synchronizing CSRF tokens with session credentials or enforcing stricter Content Security Policy directives that limit the contexts in which sensitive requests can be made. Regular audits of credential handling logic against industry standards like OWASP guidelines for identity management will help prevent similar vulnerabilities from being introduced in future updates.