CVE-2026-87598: Google Chrome vulnerability
Published Sep 9, 2026
·Updated
Incorrect authorization in ServiceWorker in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
Affected Software
1 affected component
Google Chrome<153.0.8010.36
Event History
Sep 9, 2026
CVE Published
via MITRE·12:10 AM
Data Sourced
via MITRE·12:10 AM
DescriptionWeakness
Frequently Asked Questions
1
Who is exposed to this issue?
Users of Google Chrome versions before 153.0.8010.36 are affected. Exploitation requires a user to load an attacker-crafted HTML page.
2
What security boundary could an attacker bypass?
The issue allows bypass of the web origin policy through incorrect authorization in ServiceWorker. The vulnerability is classified as Low severity by Chromium.
3
What version addresses the vulnerability?
Update Google Chrome to version 153.0.8010.36 or later.