CVE-2026-87557 in Chrome
Summary
by MITRE • 09/09/2026
Missing authorization in LocalNetworkAccess in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as missing authorization within the LocalNetworkAccess component of Google Chrome prior to version 153.0.8010.36 represents a critical failure in process isolation and access control mechanisms. This flaw specifically affects the browser's handling of network requests initiated from renderer processes, which are designed to operate with limited privileges to contain potential security breaches within isolated sandboxes. The core technical deficiency lies in the insufficient validation of authorization tokens or permissions when local network resources are accessed through HTML-based interfaces. Consequently, a remote attacker who has successfully compromised a renderer process via a separate vulnerability can exploit this gap to bypass system-level access restrictions that should normally prevent such interactions.
From an operational perspective, this flaw allows for unauthorized lateral movement within the user's environment by enabling communication with local network services that are typically restricted from web-based contexts. By crafting a specific HTML page containing malicious scripts or embedded objects, an attacker can trigger requests to internal IP addresses, localhost endpoints, or other private network resources without triggering standard security warnings or access denials. This capability significantly expands the attack surface beyond the browser sandbox, potentially leading to data exfiltration from local services, manipulation of intranet applications, or further exploitation of vulnerabilities present in locally running software that trusts requests originating from trusted browsers.
The severity of this issue is classified as medium by Chromium security standards due to its dependency on an initial compromise of the renderer process. While it does not allow direct remote code execution without a prior entry point, it effectively neutralizes one of the primary defense-in-depth layers provided by browser sandboxing. This aligns with CWE-269, which describes Improper Privilege Management, as well as CWE-862, Missing Authorization, highlighting the failure to enforce access control policies on sensitive operations. Furthermore, this behavior is consistent with ATT&CK technique T1059 Command and Scripting Interpreter when used in conjunction with network reconnaissance or lateral movement tactics such as T1046 Network Service Discovery, where attackers probe internal networks for vulnerable services after gaining initial foothold through a web browser.
Mitigation strategies primarily involve updating Google Chrome to version 153.0.8010.36 or later, which implements stricter checks within the LocalNetworkAccess module to ensure that only authorized contexts can interact with local network interfaces. Organizations should also enforce strict Content Security Policy (CSP) headers on web applications served internally to limit script execution capabilities and reduce the risk of renderer compromise in the first place. Additionally, deploying network segmentation policies can help isolate critical internal services from general user workstations, thereby reducing the impact even if a browser-based attack vector is successfully exploited. Regular patch management cycles are essential to address such vulnerabilities promptly before they can be leveraged in targeted attacks against enterprise environments.