CVE-2026-87450 in Chrome
Summary
by MITRE • 09/09/2026
Incorrect authorization in Permissions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted Chrome extension. (Chromium security severity: Medium)
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as an incorrect authorization flaw within the permissions system of Google Chrome prior to version 153.0.8010.36 represents a significant breach in the browser's access control mechanisms. This issue stems from a logical error where the application fails to properly verify whether a specific action or data request is authorized for the requesting entity, specifically within the context of installed extensions. In modern web browsers like Chrome, extensions operate with elevated privileges compared to standard web pages, allowing them to interact deeply with browser functionality and user data. When permission checks are bypassed or incorrectly evaluated, it creates an avenue for unauthorized access that undermines the fundamental security model designed to isolate content from privileged operations.
The operational impact of this vulnerability is primarily driven by its reliance on social engineering tactics rather than purely technical exploitation vectors such as buffer overflows or remote code execution without user interaction. An attacker would need to craft a malicious Chrome extension and distribute it through unofficial channels, phishing campaigns, or compromised websites that trick users into installing the package. Once installed, the flawed permission logic allows the extension to access sensitive information—such as browsing history, cookies, saved passwords, or personal data—that should have been restricted by default permissions. This results in a direct compromise of user confidentiality and privacy, potentially leading to identity theft, financial loss, or further lateral movement within an organization if corporate credentials are stored within the browser profile.
From a classification perspective, this flaw aligns with CWE-269, which denotes Improper Privilege Management, specifically where software does not properly assign privileges to actors based on their intended role or trust level. Furthermore, in terms of adversary behavior as defined by the MITRE ATT&CK framework, this vulnerability facilitates techniques associated with Collection via Browser Extension and potentially Credential Access if sensitive login data is targeted. The medium severity rating assigned by Chromium reflects the balance between the ease of exploitation through social engineering and the high value of the compromised data. It highlights that while technical barriers exist to prevent remote code execution, logical flaws in permission enforcement remain a critical attack surface for threat actors aiming at data exfiltration rather than system control.
Mitigation strategies must address both immediate remediation and long-term security hygiene. The primary defense is the prompt application of the vendor-supplied patch by upgrading Google Chrome to version 153.0.8010.36 or later, which resolves the underlying permission checking logic. For organizations managing multiple endpoints, centralized deployment tools should be utilized to ensure uniform updates across all user machines. Additionally, users and administrators should enforce strict policies regarding extension installation, such as whitelisting approved extensions via enterprise management consoles like Chrome Enterprise Browser Policy. This prevents the installation of unverified or malicious packages that could exploit this vulnerability. Security awareness training is also critical to help end-users recognize social engineering attempts designed to trick them into installing rogue browser add-ons, thereby reducing the likelihood of successful exploitation in environments where technical controls alone may not suffice.