CVE-2026-87498: Google Chrome vulnerability

Q: What does an attacker need before this issue can be exploited?

The attacker must already have compromised the Chrome renderer process. They can then use a crafted HTML page to bypass the web origin policy.

Q: Which Chrome versions are affected?

Google Chrome versions prior to 153.0.8010.36 are affected.

Published Sep 9, 2026

Updated

Missing authorization in WebUI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)

Affected Software

1 affected component

Google Chrome<153.0.8010.36

Event History

Sep 9, 2026

CVE Published

via MITRE·12:09 AM

Data Sourced

via MITRE·12:09 AM

DescriptionWeakness

Frequently Asked Questions

What does an attacker need before this issue can be exploited?

The attacker must already have compromised the Chrome renderer process. They can then use a crafted HTML page to bypass the web origin policy.

Which Chrome versions are affected?

Google Chrome versions prior to 153.0.8010.36 are affected.