External risk intelligence

Google Chrome Extension Authorization Bypass in Privileged Page

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-87544

This vulnerability affects the browser's extension mechanism, which is a client-side component. Successful exploitation requires a user to interact with a crafted HTML page within the browser. It does not represent a service or port exposed to the internet for remote access or automated interaction.

Google Chrome

before 153.0.8010.36

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This CVE describes a potential security weakness in Google Chrome's extension handling that, under specific conditions, could allow unauthorized access to a privileged page. While the reported security severity is low, the context suggests it involves bypassing system access restrictions via a crafted web page. The main concern is confirming its relevance and exposure to our environment.

Unrestricted page access in browser extensions.
Low impact, but confirms relevance to our systems.
Verify Chrome extension use and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could trick a user into visiting a malicious webpage. This page would exploit a flaw in how Chrome handles extensions, allowing the attacker to bypass security restrictions and access sensitive areas of the browser.

No authentication or user interaction needed.
Triggered by visiting a malicious HTML page.
Bypass system access restrictions.

Live Threat

Current exploitation, exposure, and threat context

An attacker could bypass system access restrictions to a privileged page in Google Chrome when supported by the advisory. This could allow them to view or modify sensitive information or alter the behavior of the affected page.

System access restrictions.
Attacker tricks user via HTML page.
Unauthorized access to privileged page data.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Google Chrome's extension authorization mechanism requires direct user interaction with a malicious HTML page. Therefore, the primary responsibility for risk reduction lies with end-users and device owners, supported by endpoint security teams to identify and mitigate exposure through device policies or browser management. The first practical step is to confirm the Chrome version on user devices and ensure that users are informed about the risks of accessing untrusted web content.

User devices and endpoint security teams.
Verify Chrome browser versions on endpoints.
Ensure users avoid untrusted web content.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Google Chrome and how do extensions work?

Google Chrome is a widely used web browser that supports extensions—small software programs that add features or modify browser behavior. Extensions often interact with internal browser processes to function, requiring strict authorization checks to ensure they only access data and pages they are specifically permitted to interact with.

What does CWE-863 mean in the context of CVE-2026-87544?

CWE-863 refers to Incorrect Authorization. In this CVE, it means the browser fails to properly verify if an extension has the correct permissions to view or interact with a privileged page. Because this check is flawed, a malicious actor could bypass the security boundaries that normally protect these sensitive internal areas of the browser.

How is the vulnerability triggered by a malicious HTML page?

The flaw is triggered when a user visits a specially crafted HTML page designed to exploit the authorization gap. The vulnerability does not automatically execute simply by having the browser installed; it requires the browser to render the malicious content, which then attempts to bypass system access restrictions into a protected page.

Is my device at risk based on Halo Surface Signal?

Halo Surface Signal indicates this vulnerability is unlikely to pose a high risk because it is a client-side issue, not a network service. Since it relies on a user visiting a specific malicious page, it is not an internet-exposed port or service that can be scanned or targeted remotely and automatically by an attacker.

What should I do to address this Google Chrome security issue?

The most effective way to secure your environment is to ensure all devices are updated to Chrome version 153.0.8010.36 or later, which contains the fix. Beyond updating, emphasize user awareness regarding the risks of visiting untrusted or suspicious websites, as the exploit path requires direct user interaction with malicious content.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.