CVE-2026-87511 in Chrome
Summary
by MITRE • 09/09/2026
Missing authorization in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafted Chrome extension. (Chromium security severity: Low)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as missing authorization within the Developer Tools component of Google Chrome represents a significant lapse in access control mechanisms that can be exploited by malicious actors through specially constructed browser extensions. This flaw stems from an insufficient verification process where the application fails to adequately check whether the requesting entity possesses the necessary privileges to access specific internal resources or data structures. In the context of web browsers, Developer Tools are intended for debugging and development purposes, often granting elevated permissions to inspect page content, network traffic, and local storage. When these tools lack proper authorization checks, they can inadvertently expose sensitive cross-origin information to extensions that should not have such access rights.
From a technical perspective, this issue allows a remote attacker who has managed to install or inject a crafted Chrome extension into the user's browser environment to bypass standard same-origin policies. The attacker leverages the privileged APIs exposed by the Developer Tools interface to retrieve data belonging to other origins, effectively breaking the isolation boundaries that protect web applications from one another. This exploitation vector relies on the trust relationship between the browser and its extensions, assuming that an extension with certain permissions can interact freely with internal debugging interfaces without rigorous validation of the context in which those interactions occur. The severity is classified as low by Chromium security standards because it requires user interaction to install the malicious extension, yet the potential for data exfiltration remains a serious concern for privacy and confidentiality.
The operational impact of this vulnerability centers on the unauthorized acquisition of cross-origin data, which can include sensitive user information such as session tokens, personal details stored in local storage, or confidential content from web applications accessed by the victim. An attacker utilizing this flaw could potentially compromise user accounts through session hijacking if authentication cookies are accessible via the exposed interfaces. Furthermore, the ability to read data across different origins undermines the fundamental security model of modern web browsers, leading to potential privacy breaches and intellectual property theft for organizations relying on secure browsing environments. The risk is compounded by the fact that users may not be aware they have installed an extension with excessive privileges or are unaware when such extensions attempt to access internal browser functions.
To mitigate this vulnerability, it is imperative to implement strict authorization checks within the Developer Tools codebase to ensure that only authorized contexts can invoke sensitive APIs. Developers should adhere to the principle of least privilege by restricting cross-origin data access unless explicitly required and verified through robust authentication mechanisms. Regular security audits and static analysis tools should be employed to detect similar flaws in extension permissions and API usage patterns. Users are advised to keep their browsers updated to version 153.0.8010.36 or later, where these authorization checks have been reinforced. Additionally, users should exercise caution when installing browser extensions, reviewing the specific permissions requested by each add-on before granting access to minimize the attack surface available for such exploitation attempts aligned with CWE-269 Improper Privilege Management and ATT&CK techniques related to collection via compromised software components.