CVE-2026-87431: High Missing Authorization in Chrome Extensions

CVE-2026-87431 is a high severity (CVSS) missing authorization flaw in the Extensions component of Google Chrome before 153.0.8010.36. A remote attacker could obtain sensitive information through a crafted Chrome extension. Google rated it Medium and fixed it in the Chrome 153 stable release.

What's affected

Affected: Google Chrome before 153.0.8010.36. Fixed in the Chrome 153 stable release, which Google announced on 8 September 2026: 153.0.8010.36 for Linux and 153.0.8010.36 or .37 for Windows and Mac, rolling out over days and weeks. The component is Extensions.

Severity differs between sources. Google's Chromium security severity for this bug is Medium. The record's CVSS 3.1 score is 7.5 (High), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. These measure different things: the Chromium rating reflects how Google judges the bug inside its security model, including mitigations such as sandboxing, while the CVSS score is a generic base metric. Plan your patch timing against both.

The Chrome 153 release notes list 230 security fixes in total. They also say Google is aware of an exploit in the wild for a different CVE in the same release, CVE-2026-87491. The release notes do not say this CVE is exploited, and the record does not list it in CISA KEV.

How to check if you're exposed

Open chrome://version in the browser, or choose Help, then About Google Chrome. The version should be 153.0.8010.36 or later. Opening the About page also triggers an update check.

For a managed fleet, use your endpoint management or browser management console to report the installed Chrome version for every device, and look for devices below 153.0.8010.36. Pay attention to machines that rarely restart the browser, because Chrome applies an update only after a relaunch.

Other Chromium based browsers, such as Edge or Brave, ship their own versions and updates. Check each vendor's advisory for when they picked up the Chrome 153 fixes, as they do not all update on the same day. Electron applications bundle their own Chromium, so check them separately.

What to do now

1. Update Chrome to 153.0.8010.36 or later and relaunch the browser.
2. For managed fleets, confirm update policies are not holding Chrome back, and check the version report for stragglers.
3. Check other Chromium based browsers and Electron applications you ship or run for their own fixed versions.
4. Review the extensions installed on managed browsers and remove ones you do not need.
5. Keep browser auto-update on as a standing control. Safeguard offers a free in-browser dependency scan at gold.safeguard.sh/scan that lists the package versions a project pulls in, which is a quick way to see whether an affected release is in your tree. Reachability analysis can then help you judge whether the vulnerable code path is actually used.

Why it matters

The weakness is missing authorization (CWE-862): a check that should decide whether a caller may do something is absent. In this case the caller is an extension, and what leaks is information the extension should not have been able to read.

The attack needs a crafted extension to be installed, which is a real barrier. But extension installs are exactly what attackers aim for through fake listings, compromised developer accounts and pressured users. Google's release notes credit Microsoft Edge with reporting it.

For organisations the lesson is extension governance: allow list the extensions that may be installed, review permissions, and remove the unused ones. A browser update closes this particular gap, and an allow list limits the next one.

Quick check

Sources

• Chrome Releases: Stable Channel Update for Desktop, 8 September 2026
• Chromium issue 523313374 (cited by the record; sign-in page when fetched)
• Safeguard Gold entry for CVE-2026-87431

Last reviewed: 18 October 2026.