CVE-2026-87626: Google Chrome vulnerability

Q: Which Chrome installations should be updated?

Google Chrome versions earlier than 153.0.8010.36 are affected. Update Chrome to version 153.0.8010.36 or later.

Q: What does an attacker need to exploit this issue?

The issue can be exploited remotely using crafted network traffic. The available information does not state that local access or prior authentication is required.

Published Sep 9, 2026

Updated

Incorrect authorization in DeviceBoundSessionCredentials in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via crafted network traffic. (Chromium security severity: Medium)

Affected Software

1 affected component

Google Chrome<153.0.8010.36

Event History

Sep 9, 2026

CVE Published

via MITRE·12:09 AM

Data Sourced

via MITRE·12:09 AM

DescriptionWeakness

Frequently Asked Questions

Which Chrome installations should be updated?

Google Chrome versions earlier than 153.0.8010.36 are affected. Update Chrome to version 153.0.8010.36 or later.

What does an attacker need to exploit this issue?

The issue can be exploited remotely using crafted network traffic. The available information does not state that local access or prior authentication is required.