CVE-2026-87473 in Chrome
Summary
by MITRE • 09/09/2026
Incorrect authorization in FileHandling in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as an incorrect authorization flaw within the FileHandling component of Google Chrome prior to version 153.0.8010.36 represents a significant breach in browser-based access control mechanisms. This specific weakness stems from improper checks performed when handling file system operations, allowing processes or scripts that should be restricted by security boundaries to gain unauthorized access to sensitive resources. The core technical flaw lies in the failure of the FileHandling module to strictly enforce authorization policies during file read and write operations initiated via web content. When a webpage attempts to interact with local files through APIs such as the File System Access API, the browser is expected to verify that the origin requesting the operation has explicit user consent or appropriate permissions. In this instance, the validation logic was insufficient, permitting actions that should have been blocked by default security policies. This misconfiguration effectively weakens the sandbox isolation that Chrome relies on to protect users from malicious web content, creating a pathway for privilege escalation within the browser context itself.
The operational impact of this vulnerability is primarily driven by its reliance on social engineering tactics rather than purely automated exploitation techniques. Because the attack vector requires user interaction, such as clicking a link or visiting a crafted HTML page, it falls under the category of attacks that exploit human trust alongside technical flaws. A remote attacker can craft an HTML page designed to trigger specific file handling behaviors in Chrome. When a victim visits this malicious site and interacts with its content, potentially by granting permissions for local file access which might be solicited through deceptive prompts or pre-texting, the flawed authorization logic allows the script to bypass system access restrictions. This could lead to unauthorized reading of sensitive files stored on the user's device, such as documents containing personal identifiable information, financial records, or proprietary business data. In more severe scenarios involving write operations, it could allow for the modification or deletion of critical local files, potentially disrupting workflow or introducing malware payloads into trusted directories.
From a classification perspective, this vulnerability aligns with CWE-269, which denotes Improper Privilege Assignment, as well as CWE-732, concerning Incorrect Permission Assignment for Critical Resource. The attack methodology is consistent with the MITRE ATT&CK framework technique T1059, specifically Command and Scripting Interpreter sub-techniques that leverage browser capabilities to execute actions on the host system. It also relates to T1089, Disabling or Modifying Security Software, if the file access allows for tampering with security configurations. The severity is rated as Low by Chromium because of the social engineering requirement, which limits the blast radius compared to fully remote zero-click exploits. However, given the sensitivity of local file systems and the potential for data exfiltration, it remains a critical concern for enterprise environments where users frequently interact with external web content while handling sensitive corporate data.
Mitigation strategies focus primarily on timely patching and user education. The most effective remediation is to update Google Chrome to version 153.0.8010.36 or later, which contains the necessary code fixes to enforce strict authorization checks during file system operations. Administrators should ensure that automatic updates are enabled for all endpoints running this browser to minimize the window of exposure. Additionally, organizations can implement application control policies using tools like Microsoft AppLocker or Windows Defender Application Control to restrict the execution of scripts and binaries from untrusted locations, thereby limiting the impact even if a user falls victim to social engineering. Security awareness training is also crucial; users should be educated on recognizing suspicious prompts requesting file access permissions and advised not to grant such rights unless they are certain of the source's legitimacy. Monitoring browser activity for unusual patterns in file system API calls can provide an additional layer of detection for potential exploitation attempts in real-time environments.