CVE-2026-87499 in Chrome
Summary
by MITRE • 09/09/2026
Incorrect authorization in Network in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as an incorrect authorization issue within the network stack of Google Chrome prior to version 153.0.8010.36 represents a critical failure in process isolation mechanisms, specifically targeting the site isolation architecture that is fundamental to modern browser security models. Site isolation is designed to ensure that resources from different origins are loaded into separate processes, thereby preventing cross-origin data leakage and mitigating attacks such as Spectre or side-channel information disclosure. By compromising the renderer process through a crafted HTML page, an attacker was able to exploit this authorization flaw to bypass these protective boundaries. This breach allows code executing within one origin to potentially access sensitive data from another origin that should have been strictly isolated in its own dedicated process context.
From a technical perspective, the root cause lies in how network requests are authorized and routed when initiated by renderer processes. The vulnerability suggests that the internal checks governing whether a specific request is permitted to cross security boundaries or interact with resources outside its designated scope were insufficiently validated. When an attacker crafts a malicious HTML page containing JavaScript that triggers these flawed authorization paths, they can manipulate the browser's network layer into treating requests from different sites as if they originated from the same origin or are otherwise permissible under relaxed constraints. This effectively neutralizes the primary defense mechanism against cross-site scripting and data exfiltration attacks that rely on process separation to contain malicious activity within a sandboxed environment.
The operational impact of this vulnerability is severe, particularly for users who visit untrusted websites or click on phishing links containing such crafted pages. An attacker with control over the renderer process can potentially read sensitive information from other tabs or windows belonging to different domains, including cookies, local storage data, and dynamic content rendered by those sites. This capability undermines user privacy and confidentiality guarantees provided by the browser. Furthermore, bypassing site isolation opens the door for more sophisticated attacks that leverage side-channel techniques to extract cryptographic keys or session tokens across process boundaries, which were previously considered safe due to strict memory separation enforced by Chrome's architecture.
This flaw aligns with Common Weakness Enumeration (CWE) category CWE-269, Improper Privilege Management, as it involves a failure to correctly enforce access controls during network operations initiated by less privileged processes. In the context of the MITRE ATT&CK framework for enterprise security, this behavior corresponds to techniques related to Defense Evasion and Credential Access, specifically methods that involve bypassing application sandbox restrictions or exploiting misconfigurations in process isolation policies. The ability to escape renderer confinement is a significant escalation of privilege within the browser's internal trust model, allowing lateral movement between isolated contexts that should remain strictly separated.
To mitigate this risk, users must ensure their Google Chrome installation is updated to version 153.0.8010.36 or later, where these authorization checks have been hardened and validated against such bypass attempts. Administrators managing enterprise deployments should enforce automatic update policies to minimize the window of exposure for all endpoints. Additionally, while browser updates are the primary defense, users can reduce risk by employing strict content security policies in web applications they develop and utilizing extensions that enhance sandboxing or restrict cross-origin requests where appropriate. Security teams should also monitor for indicators of compromise related to renderer process anomalies or unexpected network traffic patterns originating from browser processes, as these may signal active exploitation attempts targeting similar isolation flaws.