Executive brief
Google Chrome contains a weakness in how browser extensions are cleaned up after use, allowing attackers to bypass security restrictions through a malicious extension combined with social engineering. An attacker could trick a user into installing a crafted extension that persists system access beyond normal security boundaries, potentially leading to unauthorized system control.
Technical details
This vulnerability is an incomplete cleanup issue in Chrome's extension handling mechanism. The flaw allows a crafted malicious Chrome extension to bypass system access restrictions through social engineering tactics. An attacker must convince a user to install the malicious extension, making this a social-engineering-dependent attack vector. The incomplete cleanup leaves extension privileges active beyond their intended scope, potentially enabling persistence or privilege escalation. The issue is fixed in Chrome 153.0.8010.36 and later versions.
Affected products
- Google Chrome prior to 153.0.8010.36
Timeline
- 2026-09-09: disclosed: CVE-2026-87446 disclosed and published on NVD
- 2026-09-08: patched: Fix included in Chrome 153.0.8010.36 released to stable channel