CVE-2026-87475 in Chrome
Summary
by MITRE • 09/09/2026
Missing authorization in Omnibox in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Medium)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as missing authorization within the Omnibox component of Google Chrome prior to version 153.0.8010.36 represents a significant flaw in how the browser handles user input and subsequent navigation requests. The Omnibox, which serves as both the address bar and search box for users, is designed to interpret text entered by the user and determine whether it constitutes a URL or a search query. In this specific instance, the security mechanism responsible for validating authorization levels before allowing access to privileged pages failed to execute correctly when processing input from crafted HTML pages. This failure allows an attacker who has successfully tricked a victim into interacting with malicious content to bypass standard system access restrictions that are typically enforced by the browser's same-origin policy and privilege separation models.
From a technical perspective, this flaw falls under the category of improper authorization checks, which is formally classified as CWE-862 in the Common Weakness Enumeration database. The root cause lies in the logic governing how the Omnibox processes navigation events triggered by external or injected HTML content. When an attacker crafts a specific HTML page containing malicious scripts or embedded elements designed to manipulate browser behavior, they can exploit this gap to force the browser into navigating to internal or privileged URLs that should otherwise be inaccessible to unauthenticated or low-privilege contexts. The vulnerability relies heavily on social engineering tactics because it requires the victim user to initiate an action, such as clicking a link or allowing a script to execute within their browsing context, thereby providing the attacker with the necessary foothold to trigger the unauthorized navigation sequence.
The operational impact of this vulnerability is substantial, particularly in enterprise environments where Chrome is used for accessing sensitive internal applications or administrative interfaces. By bypassing system access restrictions, an attacker can gain entry into privileged pages that contain confidential data, control over critical systems, or capabilities to modify user settings and configurations. This effectively elevates the attacker's privileges from a standard browsing context to one with higher trust levels, potentially leading to full account compromise if those privileged pages expose additional attack surfaces such as cross-site scripting vulnerabilities or insecure API endpoints. The severity is rated as medium by Chromium security standards because while it requires user interaction, the consequences of successful exploitation can be severe depending on the nature of the protected resources accessed.
This type of vulnerability aligns with several tactics and techniques described in the MITRE ATT&CK framework for enterprise environments. Specifically, it relates to technique T1059, Command and Scripting Interpreter, as well as aspects of T1204, User Execution, where social engineering is used to trick users into running malicious content. The exploitation path involves leveraging trusted applications like Chrome to execute unauthorized actions, which falls under the broader category of abuse of browser functionality for lateral movement or initial access in a compromised network scenario. Defenders should be aware that such vulnerabilities often serve as entry points for more complex attacks involving data exfiltration or persistence mechanisms once privileged pages are accessed.
Mitigation strategies primarily involve updating to Google Chrome version 153.0.8010.36 or later, where the authorization checks within the Omnibox have been corrected to properly validate access rights before allowing navigation to restricted resources. In addition to patching, organizations should implement strict content security policies and disable unnecessary browser features that could be abused for such attacks. User awareness training is also critical, as social engineering remains a key vector for this vulnerability; employees must be educated on recognizing suspicious links or pages that attempt to manipulate browser behavior. Regular audits of browser configurations and the deployment of endpoint detection and response solutions can further reduce the risk associated with exploiting this class of authorization flaws in web browsers.