CVE-2026-87605 in Chrome
Summary
by MITRE • 09/09/2026
Missing authorization in Contacts in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified in Google Chrome prior to version 153.0.8010.36 represents a critical failure in access control mechanisms within the Contacts application component of the browser environment. This flaw is classified as a missing authorization issue, which fundamentally allows an attacker who has already achieved code execution within a renderer process to bypass intended security boundaries and access sensitive user data that should remain restricted. The severity of this vulnerability is assessed by Chromium developers as low due to the specific prerequisites required for exploitation, yet it remains significant because it facilitates unauthorized information disclosure through social engineering tactics rather than purely technical exploits.
The core technical flaw lies in the insufficient validation of permissions when accessing contact-related APIs or data structures from within a sandboxed renderer process. In modern browser architectures like Chromium, renderer processes are isolated to prevent malicious web content from directly affecting the rest of the system or other tabs. However, this isolation relies on strict enforcement of authorization checks whenever privileged operations are requested. In this instance, the Contacts component failed to adequately verify whether the requesting context possessed the necessary privileges to retrieve contact information. This oversight creates a pathway where code running in a compromised renderer can invoke functions that return sensitive personal data without proper authentication or permission verification from the browser's security manager.
Exploitation of this vulnerability requires a multi-stage attack vector involving both technical compromise and social engineering. An attacker must first gain control over a renderer process, which typically occurs through exploiting other vulnerabilities such as cross-site scripting (XSS) or remote code execution flaws in web content. Once inside the renderer sandbox, the attacker crafts a specific HTML page designed to trigger the unauthorized access logic within the Contacts module. The social engineering component is crucial because it ensures that the victim interacts with the malicious page while logged into their Google account and potentially granting broad permissions to extensions or services that interact with contacts. This combination allows the attacker to extract sensitive information, such as names, email addresses, phone numbers, and other personal identifiers stored in the user's contact list.
The operational impact of this vulnerability centers on privacy violations and potential downstream attacks using harvested data. While the immediate effect is the exfiltration of personally identifiable information (PII), the long-term consequences can include targeted phishing campaigns, identity theft, or further compromise of linked accounts that rely on contact-based verification methods. The low severity rating reflects the difficulty in achieving initial renderer access without prior exploitation steps, but it does not diminish the sensitivity of the data at risk. Organizations and individual users relying on Chrome for secure browsing are exposed to risks where seemingly benign web interactions can lead to significant data leakage if the browser is not updated promptly.
Mitigation strategies primarily involve immediate patching by upgrading Google Chrome to version 153.0.8010.36 or later, which addresses the authorization checks within the Contacts component. From a defensive posture perspective, users should employ strict content security policies and disable unnecessary extensions that might interact with browser APIs to reduce the attack surface for renderer compromise. Additionally, implementing multi-factor authentication on associated accounts can mitigate the impact of stolen contact data by adding layers of verification beyond simple credential theft. Security teams should monitor for indicators of social engineering campaigns targeting Chrome users, as this vulnerability is often part of broader phishing infrastructures designed to harvest personal information from high-value targets.
This incident aligns with Common Weakness Enumeration (CWE) category CWE-269, which covers Improper Privilege Management, specifically highlighting failures in verifying user permissions before granting access to resources. It also maps to the MITRE ATT&CK framework under techniques related to Collection and Exfiltration over C2 channels, particularly where compromised processes are used to gather data from local systems or applications. Understanding these mappings helps security professionals categorize similar vulnerabilities within their environments and prioritize remediation efforts based on both technical severity and potential business impact. Continuous monitoring of browser update cycles is essential for maintaining a robust defense against such access control failures in widely deployed software components.