Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-87544: Google Chrome lets crafted page access privileged content
CVE-2026-87544 · published 1 month ago
Summary
Versions of Google Chrome before 153.0.8010.36 may let a malicious web page trick the browser into opening a protected page without proper permission. This could let attackers see or interact with information they shouldn't. Update Chrome to the latest version to close the gap.
What to do
- Update google chrome to version 153.0.8010.36 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| chrome |
< 153.0.8010.36 cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* |
Original advisory text
Incorrect authorization in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromiu...
Incorrect authorization in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Low)
References
- https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_... Release Notes Vendor Advisory
- https://issues.chromium.org/issues/542355360 Permissions Required
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
9.8
Critical
Type
CWE-863Incorrect Authorization
Timeline
Published9 Sep 2026
Updated14 Oct 2026
First seen9 Sep 2026
Track software like this
Free during beta