CVE-2026-87539 in Chrome
Summary
by MITRE • 09/09/2026
Observable discrepancy in Network in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as an observable network discrepancy within the Chromium-based browser architecture, specifically affecting versions of Google Chrome prior to 153.0.8010.36, represents a significant breach in cross-origin isolation principles. This flaw stems from how the browser handles resource loading and response parsing when interacting with external domains under specific crafted conditions. The core technical issue lies in the failure to properly sanitize or isolate network responses that contain metadata or timing information which can be leveraged by malicious scripts embedded in a hostile HTML page. When a user visits such a page, the attacker's script initiates requests to target resources and monitors the resulting network activity with high precision. By analyzing subtle differences in response times, error codes, or content length variations, an adversary can infer sensitive information about cross-origin data that should remain inaccessible due to same-origin policy restrictions. This type of side-channel attack exploits the browser's internal state management rather than a direct code execution flaw, making it particularly insidious as it bypasses traditional sandboxing mechanisms designed to prevent arbitrary code execution or memory corruption.
From an operational impact perspective, this vulnerability enables data exfiltration across domain boundaries without triggering standard security alerts associated with script injection or DOM manipulation attacks. An attacker can construct a malicious webpage that loads resources from various protected domains and observes the network behavior to deduce private user information such as session tokens, personal identifiers, or configuration details stored in cross-origin storage mechanisms like cookies, local storage, or IndexedDB. The severity is classified as medium because while it does not allow direct remote code execution on the victim's machine, it facilitates unauthorized access to sensitive data that compromises user privacy and potentially leads to account takeover if session tokens are successfully harvested. This aligns with CWE-200, which categorizes information exposure vulnerabilities where an attacker gains insight into system internals or protected resources through indirect means rather than direct exploitation of a logic error in authentication or authorization routines.
The attack vector is primarily web-based and requires social engineering to lure the victim to the crafted HTML page, placing it under the category of client-side attacks within the MITRE ATT&CK framework. Specifically, this behavior correlates with techniques involving browser fingerprinting and side-channel analysis where attackers use timing attacks or resource loading patterns to infer state information. The lack of proper isolation in network response handling allows the malicious script to correlate requests made from different origins, effectively breaking the boundary that separates data belonging to one origin from another. This is particularly dangerous because modern web applications increasingly rely on cross-origin interactions for functionality such as single sign-on or API integrations, creating more surface area for this type of inference attack if the browser fails to enforce strict separation during these processes.
Mitigation strategies must focus on both immediate patching and long-term architectural improvements. The primary remediation is upgrading Google Chrome to version 153.0.8010.36 or later, where the Chromium team has addressed the underlying logic error in network response handling that allowed this discrepancy to be observable. For organizations unable to update immediately, implementing strict Content Security Policy directives can help mitigate some risks by restricting which sources are permitted for resource loading and preventing inline script execution that might facilitate such side-channel attacks. Additionally, enabling features like Cross-Origin-Opener-Policy and Cross-Origin-Embedder-Policy headers on web servers hosting sensitive applications ensures that the browser enforces stricter isolation contexts, reducing the ability of malicious scripts to access or infer data from other origins. Security awareness training for users is also critical to prevent them from visiting untrusted sites that may attempt to exploit this vulnerability through crafted pages designed to trigger the observable network discrepancies.