CVE-2026-87543 describes a missing authorization flaw in Google Chrome's Core component affecting versions before 153.0.8010.36. This vulnerability enables a remote attacker, who already controls the renderer process, to bypass the browser's site isolation security feature through a specially crafted HTML page. Site isolation is a security mechanism designed to separate different websites into different processes to prevent data leakage and cross-site attacks. The vulnerability has been publicly disclosed but lacks a CVSS score and detailed exploitation information. The vendor has published an advisory linked to a stable channel update, indicating a fix is available in version 153.0.8010.36.

The vulnerability allows bypassing site isolation, potentially weakening Chrome's defense against cross-site data leaks or attacks if the attacker has already compromised the renderer process. The impact is limited by the prerequisite that the attacker must control the renderer process. Chromium rates the severity as low, indicating limited risk or difficulty in exploitation.

A fix is available in Google Chrome version 153.0.8010.36. Users and administrators should update to this version or later to remediate the vulnerability. The vendor advisory linked provides official update information. No additional mitigation steps are indicated.