CVE-2026-87431: Google Chrome vulnerability

Q: What does an attacker need to exploit this issue?

The attacker needs to deliver or convince a user to use a crafted Chrome extension. The available information does not indicate that merely visiting a website is sufficient.

Q: Which Chrome versions should be remediated?

Google Chrome versions prior to 153.0.8010.36 are affected. Update Chrome to 153.0.8010.36 or later.

Q: What is the potential impact?

A remote attacker using a crafted extension could obtain sensitive information because of missing authorization checks in Chrome Extensions.

Published Sep 9, 2026

Updated

Missing authorization in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted Chrome extension. (Chromium security severity: Medium)

Affected Software

1 affected component

Google Chrome<153.0.8010.36

Event History

Sep 9, 2026

CVE Published

via MITRE·12:09 AM

Data Sourced

via MITRE·12:09 AM

DescriptionWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

The attacker needs to deliver or convince a user to use a crafted Chrome extension. The available information does not indicate that merely visiting a website is sufficient.

Which Chrome versions should be remediated?

Google Chrome versions prior to 153.0.8010.36 are affected. Update Chrome to 153.0.8010.36 or later.

What is the potential impact?

A remote attacker using a crafted extension could obtain sensitive information because of missing authorization checks in Chrome Extensions.