CVE-2026-87574 in Chrome
Summary
by MITRE • 09/09/2026
Information leak in ServiceWorker in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as an information leak within the Service Worker component of Google Chrome represents a significant breach in browser isolation mechanisms, specifically affecting versions prior to 153.0.8010.36. This flaw stems from improper handling of cross-origin data by the service worker runtime environment. In modern web architectures, browsers enforce strict same-origin policies to prevent malicious scripts on one domain from accessing sensitive information hosted on another. However, in this specific instance, the implementation logic failed to correctly validate or sanitize requests made through Service Workers when they involved resources across different origins. This oversight allowed a remote attacker to craft an HTML page that could exploit the service worker's ability to cache and serve network responses, thereby bypassing standard cross-origin restrictions.
From a technical perspective, this vulnerability aligns with CWE-200, which categorizes issues related to exposure of sensitive information to unauthorized actors. The core flaw lies in the failure to enforce strict origin checks during the retrieval or caching phase within the service worker scope. When a malicious webpage triggers a request that is intercepted by an active Service Worker, the browser incorrectly permits the delivery of cross-origin data back to the attacker's context. This behavior contradicts the fundamental security model of web browsers, which relies on the assumption that client-side scripts cannot read responses from origins other than their own unless explicitly permitted via CORS headers or specific APIs designed for such interactions. The severity is rated as medium because while it allows data exfiltration, it typically requires user interaction to trigger the initial page load and may be limited by existing browser security features like third-party cookie restrictions in some contexts.
The operational impact of this vulnerability enables a remote attacker to perform cross-origin information disclosure attacks. By hosting or inducing users to visit a crafted HTML page, an attacker can leverage the compromised Service Worker logic to extract sensitive data such as authentication tokens, session cookies, user profiles, or other private content residing on third-party domains that have active service workers installed. This capability undermines the confidentiality guarantees provided by web applications and can lead to account takeover, identity theft, or further exploitation if combined with other vulnerabilities like cross-site scripting. The attack vector is remote and does not require authentication for the initial exploit execution, although it may depend on whether the target site has a registered service worker that interacts in ways susceptible to this specific flaw.
Mitigation strategies primarily involve updating Google Chrome to version 153.0.8010.36 or later, where these logic errors have been corrected by the Chromium security team. For organizations unable to update immediately due to compatibility concerns, implementing strict Content Security Policy directives can help mitigate some risks by restricting how scripts interact with external resources and enforcing stricter origin checks at the application level. Additionally, developers should audit their service worker implementations to ensure they do not inadvertently cache or expose sensitive cross-origin data without proper validation. Monitoring browser security advisories from Google is essential for maintaining awareness of such vulnerabilities as web standards evolve and new attack vectors emerge against client-side runtime environments.