CVE-2026-87575 in Chrome
Summary
by MITRE • 09/09/2026
Incorrect authorization in Loader in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as an incorrect authorization flaw within the Loader component of Google Chrome prior to version 153.0.8010.36 represents a significant breach in the browser's access control mechanisms. This specific defect allows for unauthorized interactions with system resources or internal processes that should be restricted by default security policies. The core technical issue lies in how the loader handles permission checks during the execution of web content, specifically when processing HTML documents. Instead of strictly enforcing isolation boundaries between different origins and privileged contexts, the flawed logic permits a crafted webpage to execute actions that require higher levels of trust or system access than typically granted to untrusted web pages. This misconfiguration effectively weakens the sandboxing model that Chrome relies upon to protect users from malicious code execution originating from external sources.
The operational impact of this vulnerability is primarily realized through social engineering attacks, where a remote attacker tricks a user into visiting a specially crafted HTML page. Once loaded, the webpage exploits the authorization bypass to perform actions beyond its intended scope. This could include accessing sensitive browser data, interacting with local system components inappropriately, or escalating privileges within the browser's process hierarchy. Although the Chromium security severity is classified as Low, indicating that exploitation may require specific conditions or user interaction, the potential for unauthorized access remains a serious concern. Attackers can leverage this flaw to exfiltrate cookies, session tokens, or other sensitive information stored by the browser, potentially leading to account compromise or further lateral movement within an organization's network if used in conjunction with other vulnerabilities.
From a classification perspective, this vulnerability aligns closely with CWE-269, which denotes Improper Privilege Management, as it involves failing to enforce proper access rights for actors operating under different privilege levels. Additionally, the exploitation method involving crafted web pages and social engineering correlates with ATT&CK technique T1059, Command and Scripting Interpreter, specifically when used in conjunction with browser-based attacks such as those described in T1204, User Execution. The attacker relies on the user's trust to load malicious content, which then triggers the flawed authorization logic within the loader component. This highlights the persistent challenge of maintaining robust access controls in complex software ecosystems where web technologies intersect with system-level operations.
Mitigation strategies for this vulnerability center primarily around timely patching and configuration hardening. Users must update Google Chrome to version 153.0.8010.36 or later, which contains the necessary code fixes to correct the authorization checks within the loader component. In environments where immediate patching is not feasible, implementing strict content security policies can help mitigate some risks by restricting the types of scripts and resources that browsers are allowed to load from untrusted origins. Furthermore, educating users about the dangers of visiting unknown or suspicious websites serves as a critical defense-in-depth measure against social engineering tactics. Security teams should also monitor for indicators of compromise associated with browser-based exploits, such as unusual network traffic patterns or unexpected process executions following web browsing sessions, to detect potential exploitation attempts early.