CVE-2026-87537: Missing authorization in Google Chrome

CVE-2026-87537 is a vulnerability in Google Chrome Extensions where missing authorization checks in versions prior to 153.0.8010.36 could allow a remote attacker, having compromised the renderer process, to execute arbitrary code outside the sandbox by sending crafted network traffic. This elevates the attacker's capabilities beyond the sandbox restrictions, posing a significant security risk. The vulnerability is rated high severity with a CVSS 3.1 base score of 8.1, reflecting its potential impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code outside the sandbox environment, potentially leading to full compromise of the affected system. The attacker must first compromise the renderer process, after which crafted network traffic can trigger the vulnerability. This could result in unauthorized code execution with high impact on confidentiality, integrity, and availability.

A patch is available in Google Chrome version 153.0.8010.36. Users and administrators should update to this version or later to remediate the vulnerability. Refer to the official Google Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html for detailed update instructions.