CVE-2026-87436: Incomplete cleanup in Google Chrome
Description
CVE-2026-87436 is a medium severity vulnerability in Google Chrome prior to version 153.0.8010.36. It involves incomplete cleanup in the browser that allows a remote attacker, using social engineering and a crafted Chrome extension, to bypass the web origin policy. This vulnerability could lead to integrity impact without affecting confidentiality or availability.
CVSS v3.1
Score 6.5medium
Affected software
Chrome
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in Google Chrome versions before 153.0.8010.36 stems from incomplete cleanup processes in the browser. An attacker can exploit this by leveraging social engineering techniques to convince a user to install a malicious Chrome extension. This crafted extension can bypass the web origin policy, potentially allowing unauthorized actions that impact data integrity within the browser context. The CVSS v3.1 base score is 6.5, reflecting a network attack vector with low attack complexity, no privileges required, but requiring user interaction. The vulnerability does not impact confidentiality or availability but affects integrity.
Potential Impact
The vulnerability allows a remote attacker to bypass the web origin policy via a crafted Chrome extension, potentially leading to unauthorized modification or manipulation of web content or browser state. There is no impact on confidentiality or availability. Exploitation requires user interaction (social engineering). No known exploits are reported in the wild.
Mitigation Recommendations
A fix is available in Google Chrome version 153.0.8010.36. Users and administrators should update to this version or later to remediate the vulnerability. Refer to the official Google Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html for details.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Chrome
- Date Reserved
- 2026-09-08T22:22:35.193Z
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html","vendor":"Google"}]
Threat ID: 6aa0b16aacd9273b49810ef1
Added to database: 09/09/2026, 01:07:54 UTC
Last enriched: 09/17/2026, 01:25:27 UTC
Last updated: 10/23/2026, 15:10:15 UTC
Views: 33
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.