CVE-2026-87644: Incorrect authorization in Google Chrome

This vulnerability involves incorrect authorization in the Views component of Google Chrome on Windows versions before 153.0.8010.36. An attacker who has already compromised the renderer process and employs social engineering techniques can exploit this flaw by delivering a specially crafted HTML page, potentially leading to arbitrary code execution outside the sandbox environment. This elevates the risk by allowing code execution with higher privileges than normally permitted within the sandbox.

Successful exploitation can lead to arbitrary code execution outside the sandbox, compromising the security boundaries of the browser. This could allow an attacker to execute code with elevated privileges, potentially leading to full system compromise or data theft. The vulnerability requires user interaction (UI:R) and has a high impact on confidentiality, integrity, and availability.

A fix is available in Google Chrome version 153.0.8010.36. Users and administrators should update to this version or later to remediate the vulnerability. Refer to the official Google Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html for detailed update instructions.