CVE-2026-87479: Insufficient policy enforcement in Google Chrome

This vulnerability in Google Chrome's Extensions component allows insufficient policy enforcement prior to version 153.0.8010.36. An attacker who has already compromised the renderer process and leveraged social engineering techniques could potentially execute arbitrary code outside the sandbox environment by delivering a crafted HTML page. The vulnerability has a CVSS 3.1 base score of 8.3, indicating high severity, with network attack vector, high attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality, integrity, and availability.

Successful exploitation could lead to arbitrary code execution outside the sandbox, compromising the security boundaries of the browser. This could result in full system compromise, data theft, or further malware installation. The vulnerability requires user interaction and prior compromise of the renderer process, which limits the attack vector but still poses significant risk.

Google has released an official fix in Chrome version 153.0.8010.36. Users and administrators should update to this version or later to remediate the vulnerability. No additional mitigation steps are indicated by the vendor advisory.