CVE-2026-87632: XSS

Q: Which Chrome versions need to be updated?

Google Chrome versions prior to 153.0.8010.36 are affected. Update to 153.0.8010.36 or a later version.

Q: What must an attacker do to exploit this issue?

The attacker needs to get a victim to process a crafted HTML page remotely. Successful exploitation could bypass the web origin policy through the SanitizerAPI.

Published Sep 9, 2026

Updated

Cross-site scripting in SanitizerAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

Affected Software

1 affected component

Google Chrome<153.0.8010.36

Event History

Sep 9, 2026

CVE Published

via MITRE·12:09 AM

Data Sourced

via MITRE·12:09 AM

DescriptionWeakness

Frequently Asked Questions

Which Chrome versions need to be updated?

Google Chrome versions prior to 153.0.8010.36 are affected. Update to 153.0.8010.36 or a later version.

What must an attacker do to exploit this issue?

The attacker needs to get a victim to process a crafted HTML page remotely. Successful exploitation could bypass the web origin policy through the SanitizerAPI.