External risk intelligence

Chrome DevTools Authorization Bypass Allows Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-87492

The vulnerability exists within the browser's developer tools, which are client-side components primarily used by developers locally. While they can be triggered via a crafted HTML page, they are not typically exposed as an internet-facing service, gateway, or appliance, making public internet exploitation uncommon in standard deployments.

Google Chrome

before 153.0.8010.36

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability has been identified in Google Chrome's developer tools, potentially allowing attackers to execute code outside the browser's secure environment by tricking users into visiting a malicious webpage.

Flaw in developer tools permits remote code execution.
Impacts users visiting malicious websites.
Confirm if developer tools are in use.

Attack Path

How an attacker could exploit the issue

A remote attacker could trick a user into visiting a malicious web page. This page would then leverage a flaw in Chrome's developer tools to break out of the browser's security sandbox, potentially allowing the attacker to run their own code on the user's computer.

Requires visiting a malicious page.
Triggers through crafted HTML.
Risk of arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

A vulnerability in Chrome's DevTools could allow a remote attacker to execute arbitrary code outside the browser's sandbox by tricking a user into visiting a malicious webpage. This could affect the user's device and any data accessible by the browser.

Arbitrary code execution on user's device.
Triggered by visiting a crafted HTML page.
Compromise of local system and data.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Chrome's DevTools requires a user to interact with a malicious HTML page, suggesting that application owners and security teams should prioritize understanding user browsing habits and potential exposure. The first step involves identifying where Chrome is deployed, assessing if users accessing business-critical applications are susceptible, and determining the appropriate owner for remediation, which may involve coordinating with Google for browser updates.

Browser owners are accountable for this issue.
Verify user interaction with malicious pages.
Plan browser update deployment to users.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Google Chrome DevTools?

DevTools is a suite of web authoring and debugging tools built directly into the Chrome browser. It is primarily used by web developers to inspect page elements, monitor network activity, and test code performance in real-time. Because these tools have deep access to the browser's internal engine, they are separated from the standard user interface to maintain security.

What does CVE-2026-87492 mean by incorrect authorization?

This vulnerability, classified as CWE-863, means the browser fails to properly verify if a user or page has permission to perform certain actions within DevTools. Because of this oversight, an unauthorized malicious page can bypass security checks, tricking the browser into performing privileged operations that should have been restricted, ultimately leading to code execution outside the sandbox.

How is this vulnerability triggered?

An attacker triggers this flaw by luring a user to a specially crafted HTML page designed to interact with the DevTools component. Simply having Chrome installed does not make a system vulnerable; the attack requires active user interaction with the malicious site. Standard browsing that does not load or interact with the specific vulnerable DevTools functions will not trigger the flaw.

Is my organization at high risk?

Halo Surface Signal indicates the risk is unlikely for most environments. Since this flaw resides in developer tools rather than an internet-facing service or server-side gateway, it is not typically exposed to public web traffic. The primary concern is for users who browse untrusted sites while their browser environment is being actively manipulated or targeted.

How do I respond to this Chrome security update?

The most effective response is to ensure Chrome is updated to version 153.0.8010.36 or higher, which addresses the authorization flaw. Beyond patching, verify where Chrome is deployed across your systems and confirm that standard update channels are functioning correctly. Focus remediation efforts on users who frequently access high-risk or external content.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.