CVE-2026-87519 in Chrome
Summary
by MITRE • 09/09/2026
Incorrect authorization in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as an incorrect authorization flaw within the Safebrowsing component of Google Chrome prior to version 153.0.8010.36 represents a significant deviation from expected access control protocols. This issue stems from a logic error in how the browser validates user permissions or context when processing requests related to safe browsing features, which are designed to protect users by checking URLs against known malicious lists and providing warnings before navigation occurs. The core technical flaw lies in the failure of the authorization mechanism to properly enforce restrictions on specific system access functions during the evaluation process. Consequently, an attacker who can manipulate the browser's interaction with these components may bypass intended security boundaries that are meant to prevent unauthorized actions or data exposure.
The operational impact of this vulnerability is primarily realized through social engineering tactics rather than direct technical exploitation via code injection or buffer overflows. A remote attacker would need to craft a specific HTML page designed to trigger the flawed authorization logic within Safebrowsing. By luring a victim into visiting this crafted webpage, typically through phishing emails, malicious advertisements, or compromised websites, the attacker can exploit the misconfiguration in access control checks. The success of such an attack relies heavily on deceiving the user into interacting with the page in a way that triggers the vulnerable code path, thereby allowing the attacker to bypass system access restrictions that should have remained enforced during normal browsing operations.
From a classification perspective, this vulnerability aligns closely with CWE-269, which denotes Improper Privilege Management or Incorrect Authorization. It also relates to CWE-749, describing Exposure of Dangerous Method or Function to an Unauthorized Actor, as the flaw allows actions that should be restricted to higher privilege contexts or specific user states to be executed by a lower-trust context initiated via web content. In terms of offensive security frameworks, this scenario maps to MITRE ATT&CK technique T1059, Command and Scripting Interpreter, specifically when used in conjunction with browser-based execution environments like HTML applications. The attack vector is classified as Remote (Network) but requires User Interaction, placing it at a lower severity level within the Chromium security model, hence the Low rating assigned by Google’s internal assessment processes.
Mitigation strategies for this vulnerability focus primarily on software updates and user awareness training. Administrators and end-users must ensure that Google Chrome is updated to version 153.0.8010.36 or later, where the authorization logic in Safebrowsing has been corrected to properly validate access controls before allowing potentially risky operations. Additionally, since the exploitation relies on social engineering, organizations should implement robust email filtering and web gateway solutions that can detect and block links leading to suspicious HTML pages designed for such exploits. User education remains critical; employees and general users must be trained to recognize phishing attempts and avoid interacting with unexpected or untrusted web content that prompts unusual browser behaviors or permission requests. Regular security audits of browsing policies and the enforcement of strict Content Security Policies (CSP) can further reduce the attack surface by limiting what scripts and resources are allowed to execute within the browser environment, thereby mitigating the potential impact even if a user inadvertently visits a malicious site.