CVE-2026-87561 in Chrome
Summary
by MITRE • 09/09/2026
Incorrect authorization in Web Authentication in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Low)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as an incorrect authorization flaw within the Web Authentication module of Google Chrome, specifically in versions prior to 153.0.8010.36, represents a significant breach in browser-based access control mechanisms. This issue stems from a failure in the enforcement logic that governs how web origins interact with authentication services and extensions. In modern web architectures, origin policies are critical for isolating content from different sources to prevent malicious scripts on one site from accessing sensitive data or performing actions on behalf of users on another site. The flaw allows a remote attacker who has crafted a specific Chrome extension to circumvent these established boundaries, effectively tricking the browser into treating untrusted content as if it possessed legitimate privileges associated with trusted origins.
From a technical perspective, this vulnerability exploits weaknesses in how the browser validates permissions and context when processing requests initiated by extensions or web pages utilizing Web Authentication APIs. The Chromium security team has classified this issue with a Low severity rating, indicating that while the mechanism for exploitation exists, the practical impact may be constrained by specific conditions required to trigger the bypass. However, the nature of origin policy violations is inherently dangerous because they erode the fundamental trust model of the web platform. An attacker leveraging such an extension could potentially access sensitive user data, manipulate authentication states, or perform actions that should have been restricted based on the originating domain's security context.
The operational impact of this vulnerability centers on the potential for unauthorized data exposure and privilege escalation within the browser environment. By bypassing origin policies, a malicious actor can read cookies, local storage, or other session-specific information belonging to users who interact with the crafted extension. This could lead to account takeover scenarios if combined with other attack vectors such as cross-site scripting or phishing campaigns that direct victims to install the compromised extension. Furthermore, it undermines the integrity of web authentication flows, potentially allowing attackers to impersonate legitimate services or intercept sensitive credentials during the authentication process.
Mitigation strategies primarily involve updating Google Chrome to version 153.0.8010.36 or later, where these authorization checks have been corrected and strengthened. Administrators should ensure that automatic updates are enabled for all endpoints within their network to minimize exposure windows. Additionally, users and organizations should adopt strict extension management policies, only installing extensions from verified publishers and reviewing permissions carefully before installation. Implementing Content Security Policies (CSP) can also provide an additional layer of defense by restricting the sources from which scripts and other resources are loaded, thereby reducing the attack surface even if a browser vulnerability is present.
This incident aligns with Common Weakness Enumeration category CWE-269, which addresses Improper Privilege Assignment, as it involves granting capabilities to code that should not possess them based on its origin or context. It also relates to ATT&CK technique T1059, Command and Scripting Interpreter, specifically when used through browser extensions to execute malicious logic within the trusted environment of the web browser. Understanding these mappings helps security teams prioritize patching efforts and enhance monitoring for similar patterns in future vulnerability assessments.