CVE-2026-87508: Google Google Chrome vulnerability

Q: Who is exposed to this issue?

Users running Google Chrome versions earlier than 153.0.8010.36 are affected. Exploitation requires a user to load an attacker-crafted HTML page remotely.

Q: What capability could an attacker gain?

A remote attacker could bypass the web origin policy, which is intended to isolate content from different web origins.

Q: How can I determine whether remediation is needed?

Check the installed Google Chrome version. Versions prior to 153.0.8010.36 require updating to address this issue.

Published Sep 9, 2026

Updated

Incorrect authorization in Loader in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

Affected Software

1 affected component

Google Google Chrome<153.0.8010.36

Event History

Sep 9, 2026

CVE Published

via MITRE·12:09 AM

Data Sourced

via MITRE·12:09 AM

DescriptionWeakness

Frequently Asked Questions

Who is exposed to this issue?

Users running Google Chrome versions earlier than 153.0.8010.36 are affected. Exploitation requires a user to load an attacker-crafted HTML page remotely.

What capability could an attacker gain?

A remote attacker could bypass the web origin policy, which is intended to isolate content from different web origins.

How can I determine whether remediation is needed?

Check the installed Google Chrome version. Versions prior to 153.0.8010.36 require updating to address this issue.