CVE-2026-87453: Confused deputy in Google Chrome

This vulnerability is a confused deputy flaw in the BackgroundFetch feature of Google Chrome before version 153.0.8010.36. An attacker who has already compromised the renderer process can exploit this flaw by using a specially crafted HTML page to leak sensitive information. The issue is classified as medium severity by Chromium security. The vulnerability was published on September 9, 2026, and affects Chrome desktop versions prior to 153.0.8010.36. There is no CVSS score or explicit remediation level provided, but a vendor advisory for a stable channel update is available.

The impact is limited to information leakage of sensitive data by a remote attacker who has compromised the renderer process. This does not indicate remote code execution or privilege escalation beyond the renderer compromise. The severity is medium, reflecting a moderate risk of sensitive information exposure.

A fix is available in Google Chrome version 153.0.8010.36 as indicated by the vendor advisory for the stable channel update. Users should update to this version or later to remediate the vulnerability. Since this is a client-side browser vulnerability, updating the browser is the primary mitigation step.