CVE-2026-87477 in Chrome
Summary
by MITRE • 09/09/2026
Information leak in Core in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Low)
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as an information leak within the core components of Google Chrome, specifically affecting versions prior to 153.0.8010.36, represents a significant breach in browser isolation and data confidentiality protocols. This flaw allows a remote attacker to extract sensitive information from the user's browsing session or system state through the delivery of a specially crafted HTML page. The severity is classified as low by Chromium security standards, indicating that while the exploitability is relatively straightforward for an attacker with web access, the potential impact on overall system compromise is limited compared to critical memory corruption vulnerabilities such as use-after-free or buffer overflow issues. However, even low-severity information leaks can serve as valuable reconnaissance tools in broader attack chains, potentially revealing session tokens, internal IP addresses, or other metadata that aids in further exploitation attempts against enterprise environments or high-value targets.
From a technical perspective, this vulnerability likely stems from improper handling of memory allocation or data exposure within the browser's core rendering engine or networking stack. When a user visits a maliciously constructed webpage, the crafted HTML code triggers an unintended disclosure mechanism where sensitive data is exposed to scripts running in the context of that page. This could involve leaking variables, DOM elements, or internal state information that should remain isolated from untrusted web content. The attack vector relies on social engineering or drive-by download tactics, requiring only a user interaction such as loading the webpage. Once executed, the malicious script can read and exfiltrate this leaked data to an external server controlled by the attacker, bypassing standard same-origin policies if the flaw affects cross-context isolation mechanisms.
The operational impact of this vulnerability is primarily centered on privacy violations and potential credential theft depending on what specific information is exposed. If session cookies or authentication tokens are leaked, attackers could hijack user sessions without needing to steal passwords directly. In enterprise settings, leaking internal network topology details via browser-based side channels can facilitate lateral movement by providing attackers with a map of the local network infrastructure. Although the Chromium security team has rated this as low severity, it underscores the importance of maintaining strict isolation boundaries between different browsing contexts and ensuring that sensitive data is never inadvertently exposed to untrusted script execution environments.
To mitigate the risks associated with this vulnerability, organizations must ensure that all instances of Google Chrome are updated to version 153.0.8010.36 or later immediately upon availability. This patch addresses the underlying flaw in the core component responsible for the data leakage. In addition to software updates, security administrators should enforce strict Content Security Policies (CSP) across web applications hosted within their domains to minimize the impact of any potential script injection attacks. Users should also be educated on recognizing suspicious links and avoiding interaction with untrusted websites that may attempt to exploit browser vulnerabilities. Regular auditing of browser configurations and disabling unnecessary plugins or extensions can further reduce the attack surface available to remote attackers seeking to leverage such information leaks for malicious purposes.
This incident aligns with Common Weakness Enumeration (CWE) category CWE-200, which covers Exposure of Sensitive Information to an Unauthorized Actor. It also relates to MITRE ATT&CK technique T1537, specifically the component Transfer Data over a Different Channel or Side Channel if the leak occurs through non-standard network paths, though it more directly maps to general data exfiltration via web-based exploits. Maintaining up-to-date browser versions remains the most effective defense against such vulnerabilities, as they are typically patched quickly once identified by security researchers and internal teams within major software vendors like Google.