CVE-2026-87441: Missing authorization in Google Chrome
Description
A missing authorization vulnerability in the Downloads component of Google Chrome prior to version 153.0.8010.36 allows a remote attacker to bypass system access restrictions by using a crafted Chrome extension. This issue has been assigned CVE-2026-87441 and is rated with medium severity. The vulnerability could lead to integrity impact without affecting confidentiality or availability.
CVSS v3.1
Score 6.5medium
Affected software
Chrome
pkg:github/chromium/chromiumRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-87441 is a vulnerability in Google Chrome's Downloads feature before version 153.0.8010.36. It involves missing authorization checks that enable a remote attacker to bypass system access restrictions through a specially crafted Chrome extension. The CVSS v3.1 base score is 6.5, reflecting a network attack vector with low attack complexity, no privileges required, and user interaction needed. The impact affects integrity but not confidentiality or availability.
Potential Impact
The vulnerability allows an attacker to bypass system access restrictions, potentially modifying or interfering with system operations via a malicious Chrome extension. There is no impact on confidentiality or availability. The integrity of the system or user data could be compromised.
Mitigation Recommendations
A fix is available in Google Chrome version 153.0.8010.36. Users and administrators should update to this version or later to remediate the vulnerability. Refer to the official Google Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html for details.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Chrome
- Date Reserved
- 2026-09-08T22:22:45.920Z
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html","vendor":"Google"}]
Threat ID: 6aa0b16cacd9273b49810f1f
Added to database: 09/09/2026, 01:07:56 UTC
Last enriched: 09/17/2026, 01:34:27 UTC
Last updated: 10/23/2026, 15:10:15 UTC
Views: 28
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.