CVE-2026-87560: Google Chrome vulnerability
Missing authorization in Browser in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 153.0.8010.36
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker needs to induce a user to load a crafted HTML page in an affected Chrome version. The available information does not state that authentication, local access, or additional browser permissions are required.
Which Chrome versions should be prioritized for remediation?
Google Chrome versions prior to 153.0.8010.36 are affected. Update affected desktop Chrome installations to 153.0.8010.36 or later.
What can be done if the browser cannot be updated immediately?
The provided information identifies crafted HTML content as the attack vector. Until updates can be deployed, reduce users' exposure to untrusted web pages and HTML content where operationally possible.