CVE-2026-87429: Missing authorization in Google Chrome

CVE-2026-87429 is a vulnerability in Google Chrome's ServiceWorker implementation where missing authorization checks allow a remote attacker, who has already compromised the renderer process, to bypass system access restrictions by delivering a crafted HTML page. This flaw affects Chrome versions prior to 153.0.8010.36. The vulnerability is rated medium severity with a CVSS 3.1 base score of 6.5, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. Google has issued a stable channel update that addresses this vulnerability.

An attacker who has compromised the renderer process can exploit this vulnerability to bypass system access restrictions, potentially leading to unauthorized actions that impact the integrity of the system. There is no impact on confidentiality or availability. The vulnerability requires user interaction and network access but no privileges.

Google has released an official fix in Chrome version 153.0.8010.36. Users and administrators should update to this version or later to remediate the vulnerability. No additional mitigation steps are indicated by the vendor advisory.