CVE-2026-87652 in Chrome
Summary
by MITRE • 09/09/2026
Incorrect authorization in PushAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as an incorrect authorization flaw within the PushAPI of Google Chrome prior to version 153.0.8010.36 represents a significant breach in browser-level isolation mechanisms. This specific defect allows for the bypassing of web origin policies, which are fundamental security constructs designed to restrict how documents or scripts loaded from one origin can interact with resources from another origin. The core technical flaw lies in the insufficient validation of authorization contexts when handling push notification requests. In a properly secured environment, the browser must strictly verify that the requesting entity possesses the necessary permissions and originates from an authorized source before granting access to sensitive APIs. However, due to this implementation error, the renderer process fails to enforce these checks adequately, creating a pathway for unauthorized data exfiltration or state manipulation.
The operational impact of this vulnerability is particularly severe because it leverages a compromised renderer process as the attack vector. In modern browser architectures like Chromium, each tab and extension runs in its own sandboxed renderer process to limit the damage caused by potential exploits. Typically, if an attacker compromises one renderer through a separate vulnerability such as a cross-site scripting (XSS) or remote code execution flaw, they are confined within that specific origin's security boundary. This particular defect allows an attacker who has already gained control over a compromised renderer to escalate their privileges beyond the intended scope. By crafting a malicious HTML page that exploits the PushAPI authorization gap, the attacker can trick the browser into treating requests from untrusted origins as if they were legitimate and authorized.
This capability effectively neutralizes one of the most critical defenses against cross-origin attacks. Web origin policies are essential for preventing data theft across different websites, ensuring that a malicious site cannot read cookies, local storage, or DOM content belonging to another site where the user is logged in. By bypassing these restrictions via the PushAPI, an attacker can potentially access sensitive information stored within the browser context of other origins. This could lead to session hijacking, credential theft, or unauthorized actions performed on behalf of the victim under their authenticated sessions with various web services. The severity rating of Medium reflects that while exploitation requires a pre-existing compromise in the renderer, the resulting impact is substantial due to the broad scope of data and functionality exposed by breaking origin isolation.
From a classification perspective, this vulnerability aligns closely with CWE-269, which denotes Improper Authorization, as it involves granting access rights without proper verification of user privileges or context. Furthermore, in terms of tactical mapping within the MITRE ATT&CK framework for enterprise security, this behavior is consistent with techniques related to Defense Evasion and potentially Data Exfiltration over Alternative Protocol if push channels are abused for covert communication. The exploitation relies on manipulating API calls that should be strictly gated by origin checks, highlighting a failure in input validation regarding source identity within the browser's internal logic.
Mitigation strategies primarily involve updating Google Chrome to version 153.0.8010.36 or later, where these authorization checks have been corrected and enforced more rigorously. For organizations unable to patch immediately due to compatibility concerns, implementing strict Content Security Policy (CSP) directives can help mitigate the impact by restricting which origins are allowed to execute scripts or make API calls within their web applications. Additionally, disabling unnecessary browser features such as push notifications for untrusted sites may reduce the attack surface available to an attacker who has managed to compromise a renderer process. Continuous monitoring of browser console logs and network traffic for anomalous push notification requests can also aid in detecting potential exploitation attempts in real-time environments.