CVE-2026-87632 in Chrome
Summary
by MITRE • 09/09/2026
Cross-site scripting in SanitizerAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as Cross-Site Scripting within the SanitizerAPI of Google Chrome prior to version 153.0.8010.36 represents a significant deviation from expected web isolation boundaries, allowing for unauthorized script execution in contexts where it should be restricted. The Sanitizer API is designed specifically to provide developers with a safe way to sanitize HTML content by removing potentially dangerous elements and attributes before rendering them on the page. This mechanism serves as a critical defense layer against stored or reflected cross-site scripting attacks when handling user-generated content. However, flaws in the implementation of this sanitizer logic permitted an attacker to craft malicious HTML payloads that evaded the sanitization rules, thereby bypassing the browser's origin policy protections.
From a technical perspective, the core flaw lies in how the Sanitizer API processes and validates input against its allowlist or denylist configurations. In many such vulnerabilities, the issue stems from incomplete validation of specific HTML tags or attributes, particularly those that can trigger script execution through event handlers or protocol-based injection vectors like javascript: URIs. By exploiting these gaps, a remote attacker could inject executable JavaScript code into a victim's browser session under the context of the vulnerable website. This effectively neutralizes the same-origin policy, which is fundamental to web security as it prevents malicious scripts on one page from accessing data or performing actions on another site with a different origin.
The operational impact of this vulnerability is severe for any application relying heavily on dynamic HTML rendering and user input sanitization. Successful exploitation allows an attacker to steal sensitive information such as session cookies, authentication tokens, or personal data displayed within the DOM. Furthermore, it enables account takeover attacks if combined with other vectors like phishing, or facilitates further malware distribution by redirecting users to malicious sites. Since this is a client-side vulnerability affecting Chrome browsers prior to the specified patch version, any user visiting a compromised webpage that utilizes vulnerable implementations of third-party libraries or custom sanitization logic built on top of the Sanitizer API could be affected without their knowledge or consent.
This incident aligns with CWE-79, which classifies improper neutralization of input during web page generation as Cross-site Scripting. It also maps to MITRE ATT&CK technique T1059, specifically sub-technique 006 for JavaScript execution, illustrating how attackers leverage browser-native APIs to execute arbitrary code within the trusted environment of a victim's session. The severity rating of Medium by Chromium reflects that while exploitation requires user interaction such as visiting a crafted page, the potential for data exfiltration and identity theft is high due to the bypass of origin policies.
To mitigate this risk, organizations must ensure all instances of Google Chrome are updated to version 153.0.8010.36 or later immediately upon availability. Developers utilizing the Sanitizer API should review their implementation strategies, ensuring that they rely on up-to-date browser versions and avoid custom sanitization logic that might duplicate flawed behaviors found in older engine implementations. Additionally, implementing Content Security Policy headers can provide an additional layer of defense by restricting script sources and preventing inline scripts from executing even if injected into the DOM. Regular security audits and penetration testing focused on input validation and output encoding practices are essential to identify similar weaknesses before they can be exploited in production environments.