CVE-2026-87479 in Chrome
Summary
by MITRE • 09/09/2026
Insufficient policy enforcement in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified in Google Chrome prior to version 153.0.8010.36 represents a critical failure in the enforcement of extension policies, specifically within the context of browser extensions operating under elevated privileges compared to standard web content. This flaw allows for an escalation of privilege from a sandboxed renderer process to the broader system environment, bypassing the security boundaries designed to isolate untrusted code. The core technical issue lies in how Chrome handles policy directives when interacting with extension APIs. While modern browsers employ strict Content Security Policies and origin checks to prevent malicious scripts from accessing sensitive data or executing arbitrary commands, this specific instance reveals a gap where certain policy constraints were not adequately validated before allowing an action that could lead to code execution outside the sandboxed environment. This indicates a logic error in the permission checking mechanism rather than a simple memory corruption bug, highlighting the complexity of maintaining security boundaries when extensions are granted broader access rights for legitimate functionality.
The operational impact of this vulnerability is severe because it facilitates arbitrary code execution on the victim's machine under the context of the current user. Although an attacker must first compromise the renderer process, which typically limits their ability to directly interact with the operating system, the exploitation of this policy enforcement flaw allows them to break out of that isolation. This breakout enables the injection and execution of malicious payloads in a less restricted environment. The requirement for social engineering suggests that the attack vector relies on tricking the user into interacting with a crafted HTML page or extension interface, thereby leveraging human error to trigger the technical exploit. Once executed outside the sandbox, the attacker gains significant control over the system, potentially leading to data theft, installation of persistent malware, or use of the device as part of a botnet. The Chromium security team classified this issue as Medium severity, reflecting that while it requires specific conditions such as renderer compromise and user interaction, its potential for full system compromise makes it a high-risk vulnerability in real-world scenarios where attackers frequently combine multiple techniques to achieve their goals.
From an industry standards perspective, this vulnerability aligns with CWE-284 Improper Access Control, specifically regarding the failure to enforce proper restrictions on privileged operations within extension contexts. It also relates closely to CWE-798 Use of Hard-coded Credentials if the policy enforcement relied on static checks that could be bypassed through crafted inputs. In terms of offensive security frameworks like MITRE ATT&CK, this exploit maps directly to T1055 Process Injection and potentially T1211 Exploitation for Defense Evasion, as it involves manipulating browser processes to execute code in a way that evades standard detection mechanisms. The social engineering component further ties into T1566 Phishing, emphasizing the need for holistic security strategies that address both technical controls and user awareness.
Mitigation efforts primarily involve updating Google Chrome to version 153.0.8010.36 or later, where these policy enforcement gaps have been addressed by developers through stricter validation of extension permissions and enhanced sandboxing protocols. Administrators should ensure automatic updates are enabled for all endpoints running the browser to minimize exposure windows. Additionally, organizations can reduce risk by restricting which extensions are permitted via group policies, thereby limiting the attack surface available to potential adversaries who might attempt to leverage compromised renderer processes. Security teams should also monitor for unusual process creation events originating from Chrome binaries, as this could indicate an active exploitation attempt of similar vulnerabilities in older versions that have not yet been patched.