CVE-2026-87459 in Chrome
Summary
by MITRE • 09/09/2026
Observable discrepancy in Select in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as an observable discrepancy in the Select element within versions of Google Chrome prior to 153.0.8010.36 represents a classic instance of cross-site data leakage through DOM manipulation and timing analysis. This flaw resides in how the browser handles user interface components, specifically the HTML select tag which is used for dropdown menus. When an attacker crafts a malicious webpage containing this element, they can exploit subtle behavioral differences or state exposure mechanisms inherent to the rendering engine. The core technical issue involves the browser failing to properly isolate or obscure information about the underlying data structure associated with the select component from external scripts running in different origins. This lack of strict separation allows a remote attacker to infer sensitive details that should remain hidden, such as the existence of specific options, their values, or potentially metadata related to user interactions on other sites if frame isolation is compromised.
From an operational perspective, this vulnerability enables information disclosure attacks where a malicious actor can gather intelligence about a victim's browsing context without direct access to private data like passwords or cookies in most standard configurations. However, the ability to detect specific states or discrepancies within UI elements can be leveraged for fingerprinting users across sessions or sites. Attackers may use this technique to build detailed profiles of individuals based on their interaction patterns with web forms or dropdown menus. While classified as a low severity issue by Chromium security standards due to the limited scope of data directly exfiltrated, it contributes significantly to broader surveillance capabilities and can serve as an initial vector for more complex attacks such as cross-site scripting amplification or session hijacking if combined with other vulnerabilities in the browser's rendering pipeline.
This type of flaw aligns closely with CWE-200 which defines exposure of sensitive information to an unauthorized actor, specifically under categories related to timing side-channels and DOM-based leakage. In terms of offensive security frameworks like MITRE ATT&CK, this behavior falls under T1537 which covers communication through application layer protocols for data exfiltration or reconnaissance via browser-side mechanisms. The attack vector is primarily remote with no user interaction required beyond visiting the crafted page, making it a significant concern in environments where users frequently navigate untrusted websites.
Mitigation strategies focus heavily on timely patching and defense-in-depth measures. Users must update Google Chrome to version 153.0.8010.36 or later immediately upon availability, as this release contains the necessary code fixes to enforce stricter isolation between DOM elements and external scripts. Administrators should also implement Content Security Policy headers that restrict inline script execution and limit access to certain browser APIs used for timing analysis. Additionally, deploying extensions that block known malicious domains can reduce exposure risk while patches are being distributed across enterprise environments. Regular security audits of web applications hosted internally should include checks for improper handling of form elements to prevent similar issues from arising in custom-built interfaces.