CVE-2026-87439: Infoleak

Q: What access does an attacker need to exploit this issue?

The attacker must already have compromised the Chrome renderer process. The issue is then triggered through a crafted HTML page to obtain sensitive information.

Q: Which Chrome versions are affected?

Google Chrome versions prior to 153.0.8010.36 are affected.

Q: Is visiting a crafted page alone sufficient for exploitation?

No. The provided information specifies that exploitation requires a compromised renderer process in addition to a crafted HTML page.

Published Sep 9, 2026

Updated

Information leak in ServiceWorker in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

Affected Software

1 affected component

Google Chrome<153.0.8010.36

Event History

Sep 9, 2026

CVE Published

via MITRE·12:09 AM

Data Sourced

via MITRE·12:09 AM

DescriptionWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The attacker must already have compromised the Chrome renderer process. The issue is then triggered through a crafted HTML page to obtain sensitive information.

Which Chrome versions are affected?

Google Chrome versions prior to 153.0.8010.36 are affected.

Is visiting a crafted page alone sufficient for exploitation?

No. The provided information specifies that exploitation requires a compromised renderer process in addition to a crafted HTML page.