Incorrect authorization in Loader in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system… (CVE-2026-87575)
Source GCVE Database
Not known to be exploited.
Data as of 10/25/2026, 04:40:14 UTC
CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 11% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
What to do
AI-suggested
Until official fixes or updates are announced, users should exercise caution with untrusted web content and avoid interacting with suspicious pages that could leverage social engineering.
Description
An incorrect authorization vulnerability exists in the Loader component of Google Chrome versions prior to 153.0.8010.36. This flaw allows a remote attacker to bypass system access restrictions by leveraging social engineering and a crafted HTML page. The vulnerability is rated as low severity by the Chromium security team, with no known exploits in the wild and no explicit patch information available.
Impact
The vulnerability allows unauthorized system access bypass via social engineering and a crafted HTML page. However, the impact is limited by the need for user interaction and social engineering. There are no known active exploits in the wild, and the Chromium security team rates the severity as low.
Weaknesses
- CWE-863Incorrect Authorization (opens in a new tab)
Class weaknessLikelihood of exploit: HighCWE Top 25 (2025): #17OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.