CVE-2026-87619
Summary
by MITRE • 09/09/2026
Observable discrepancy in Prefetch in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as an observable discrepancy in the prefetch mechanism within versions of Google Chrome prior to 153.0.8010.36 represents a significant breach in browser isolation principles, specifically targeting cross-origin data leakage. This flaw stems from how the browser handles resource preloading and caching strategies when processing requests initiated by web pages. Prefetching is a standard optimization technique used to anticipate user navigation or content needs, thereby reducing latency. However, if the implementation fails to strictly enforce origin boundaries during this process, it can inadvertently expose sensitive data belonging to one domain to another unrelated domain. In this specific instance, an attacker could craft a malicious HTML page that triggers prefetch requests designed to exploit inconsistencies in how Chrome validates and caches responses from different origins.
From a technical perspective, the core issue lies in the failure of the browser's security model to properly segregate resources fetched via prefetch mechanisms based on their origin. When a user visits a webpage controlled by an attacker, the malicious script can initiate requests that appear legitimate but are designed to probe or retrieve data from other domains where the victim might have active sessions or sensitive information stored in cookies and local storage. Because prefetch operations often bypass certain standard security checks applied during explicit navigation or fetch API calls, they create a side-channel through which cross-origin data can be inferred or directly accessed. This discrepancy allows for timing attacks or cache-based oracle techniques that reveal whether specific resources exist or contain particular content, effectively leaking information across origin boundaries.
The operational impact of this vulnerability is primarily centered on privacy violations and potential session hijacking scenarios. By leveraging the prefetch mechanism to leak cross-origin data, a remote attacker can gather intelligence about a user's browsing habits, accessed websites, and potentially authenticated states on other services. This capability undermines the fundamental Same-Origin Policy that protects web applications from malicious scripts running on different sites. Although classified with low severity in Chromium’s internal metrics due to the complexity required for exploitation or the limited scope of data typically exposed, such vulnerabilities contribute to a broader attack surface where cumulative effects can lead to severe privacy breaches. Attackers could use this information to refine phishing campaigns, perform targeted social engineering attacks, or facilitate further reconnaissance against high-value targets.
To mitigate risks associated with this vulnerability, users are strongly advised to update Google Chrome immediately to version 153.0.8010.36 or later, where the prefetch logic has been corrected to enforce strict origin checks and prevent unauthorized data leakage. For organizations managing large fleets of browsers, deploying automated patch management solutions ensures that these security updates are applied consistently across all endpoints. Additionally, implementing Content Security Policy headers can help restrict resource loading behaviors and reduce the attack surface by limiting which origins are allowed to prefetch resources from specific domains. Monitoring browser network logs for unusual prefetch patterns may also aid in detecting exploitation attempts in real-time environments where immediate patching is not feasible.
This vulnerability aligns with Common Weakness Enumeration category CWE-200, which covers Exposure of Sensitive Information to an Unauthorized Actor, as well as aspects of CWE-359 regarding Privacy Violations involving the exposure of user data through side channels. In terms of offensive security frameworks, it relates to ATT&CK technique T1078, specifically Valid Accounts and potentially T1046 Network Service Discovery if used for reconnaissance purposes. Understanding these classifications helps in mapping browser-specific flaws to broader cybersecurity standards and ensures that remediation efforts address both the immediate technical flaw and its implications within established security governance models.