CVE-2026-87511: Google Chrome vulnerability

Q: What must an attacker provide to exploit this issue?

The attacker needs to get a user to use a crafted Chrome extension. The available data does not indicate that a website alone can exploit the issue.

Q: What data could be exposed if exploitation succeeds?

A successful attack can obtain cross-origin data through the DevTools authorization flaw. The available information does not identify particular websites, data types, or user permissions involved.

Q: Which Chrome versions should be updated?

Google Chrome versions prior to 153.0.8010.36 are affected. Updating to 153.0.8010.36 or later addresses the affected version range described.

Published Sep 9, 2026

Updated

Missing authorization in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafted Chrome extension. (Chromium security severity: Low)

Affected Software

1 affected component

Google Chrome<153.0.8010.36

Event History

Sep 9, 2026

CVE Published

via MITRE·12:10 AM

Data Sourced

via MITRE·12:10 AM

DescriptionWeakness

Frequently Asked Questions

What must an attacker provide to exploit this issue?

The attacker needs to get a user to use a crafted Chrome extension. The available data does not indicate that a website alone can exploit the issue.

What data could be exposed if exploitation succeeds?

A successful attack can obtain cross-origin data through the DevTools authorization flaw. The available information does not identify particular websites, data types, or user permissions involved.

Which Chrome versions should be updated?

Google Chrome versions prior to 153.0.8010.36 are affected. Updating to 153.0.8010.36 or later addresses the affected version range described.