CVE-2026-87517: Race Condition

Q: Which users are exposed to this issue?

Users of Google Chrome for iOS running a version earlier than 153.0.8010.36 are affected. Exploitation requires the user to be socially engineered into opening a crafted HTML page.

Q: What security boundary can exploitation bypass?

Successful exploitation can bypass the web origin policy, which is intended to isolate content from different web origins.

Published Sep 9, 2026

Updated

Race condition in Mobile in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)

Affected Software

1 affected component

Google Chrome for iOS<153.0.8010.36

Event History

Sep 9, 2026

CVE Published

via MITRE·12:09 AM

Data Sourced

via MITRE·12:09 AM

DescriptionWeakness

Frequently Asked Questions

Which users are exposed to this issue?

Users of Google Chrome for iOS running a version earlier than 153.0.8010.36 are affected. Exploitation requires the user to be socially engineered into opening a crafted HTML page.

What security boundary can exploitation bypass?

Successful exploitation can bypass the web origin policy, which is intended to isolate content from different web origins.