CVE-2026-87561: Google Chrome vulnerability

Q: What does an attacker need to exploit this issue?

The issue requires a crafted Chrome extension. The description does not state whether the extension must be installed by the user or how it is delivered.

Q: Which Chrome versions are affected?

Google Chrome versions prior to 153.0.8010.36 are affected. Updating to 153.0.8010.36 or later addresses the affected version range.

Q: What security boundary could be bypassed?

A remote attacker could bypass the web origin policy through the incorrect authorization in Web Authentication. The provided data does not identify specific websites, extension permissions, or authentication flows affected.

Published Sep 9, 2026

Updated

Incorrect authorization in Web Authentication in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Low)

Affected Software

1 affected component

Google Chrome<153.0.8010.36

Event History

Sep 9, 2026

CVE Published

via MITRE·12:10 AM

Data Sourced

via MITRE·12:10 AM

DescriptionWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

The issue requires a crafted Chrome extension. The description does not state whether the extension must be installed by the user or how it is delivered.

Which Chrome versions are affected?

Google Chrome versions prior to 153.0.8010.36 are affected. Updating to 153.0.8010.36 or later addresses the affected version range.

What security boundary could be bypassed?

A remote attacker could bypass the web origin policy through the incorrect authorization in Web Authentication. The provided data does not identify specific websites, extension permissions, or authentication flows affected.