CVE-2026-87606: Google Google Chrome vulnerability

Q: What must an attacker achieve before exploiting this issue?

The attacker must already have compromised the Chrome renderer process. The bypass is then triggered using a crafted HTML page.

Q: Which Chrome versions are affected?

Google Chrome versions prior to 153.0.8010.36 are affected.

Q: What security boundary can be bypassed?

A compromised renderer can bypass Chrome's site isolation protections.

Published Sep 9, 2026

Updated

Missing authorization in SiteIsolation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)

Affected Software

1 affected component

Google Google Chrome<153.0.8010.36

Event History

Sep 9, 2026

CVE Published

via MITRE·12:09 AM

Data Sourced

via MITRE·12:09 AM

DescriptionWeakness

Frequently Asked Questions

What must an attacker achieve before exploiting this issue?

The attacker must already have compromised the Chrome renderer process. The bypass is then triggered using a crafted HTML page.

Which Chrome versions are affected?

Google Chrome versions prior to 153.0.8010.36 are affected.

What security boundary can be bypassed?

A compromised renderer can bypass Chrome's site isolation protections.