CVE-2026-87541 is an information leak vulnerability in Google Chrome's navigation subsystem affecting versions before 153.0.8010.36. It enables a remote attacker with control over the renderer process to bypass site isolation protections via a crafted HTML page. Site isolation is a security feature designed to separate different sites into different processes to prevent data leaks. This vulnerability could weaken that protection, potentially exposing sensitive information across site boundaries. The vulnerability is classified as medium severity by Chromium security, with no CVSS score assigned. The vendor advisory is referenced but does not explicitly state if a patch is available or if the issue is mitigated in the stated version.

The vulnerability allows an attacker who has already compromised the renderer process to bypass site isolation, potentially leading to unauthorized information disclosure across site boundaries. This could expose sensitive data that site isolation is intended to protect. However, exploitation requires prior compromise of the renderer process, limiting the attack scope. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html for current remediation guidance. Until official confirmation, users should update to version 153.0.8010.36 or later once available. No additional mitigation steps are specified in the advisory.