CVE-2026-87475: Missing authorization in Google Chrome

CVE-2026-87475 describes a missing authorization flaw in the Omnibox feature of Google Chrome versions before 153.0.8010.36. This flaw enables a remote attacker to bypass system access controls and reach privileged pages by tricking a user into visiting a specially crafted HTML page. The vulnerability does not impact confidentiality or availability but can lead to integrity violations. The CVSS v3.1 base score is 6.5, reflecting medium severity with network attack vector, low attack complexity, no privileges required, user interaction needed, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact.

An attacker can remotely bypass system access restrictions to access privileged pages in the browser by leveraging social engineering techniques. This could allow unauthorized modification or manipulation of privileged content or settings, impacting the integrity of the system. There is no impact on confidentiality or availability. No known exploits are reported in the wild.

A fix is available in Google Chrome version 153.0.8010.36. Users and administrators should update to this version or later to remediate the vulnerability. Refer to the official Google Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html for details.