Incorrect authorization in SiteIsolation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process… (CVE-2026-87589)
Source GCVE Database
Not known to be exploited · fixed in 153.0.8010.36 : update affected systems when convenient.
Data as of 10/25/2026, 04:40:14 UTC
CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 17% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 153.0.8010.36
What to do
AI-suggested
A fix is available in Google Chrome version 153.0.8010.36 and later. Users and administrators should update to this version or newer to remediate the vulnerability. No additional mitigation steps are indicated by the vendor.
Description
An incorrect authorization vulnerability exists in the SiteIsolation feature of Google Chrome versions prior to 153.0.8010.36. This flaw allows a remote attacker who has already compromised the renderer process to bypass system access restrictions by leveraging a crafted HTML page. The vulnerability is rated medium severity by Chromium security. There are no known exploits reported in the wild and no CVSS score is available.
Impact
The vulnerability allows an attacker who has already compromised the renderer process to bypass system access controls, potentially escalating their privileges or accessing restricted system resources. However, exploitation requires prior compromise of the renderer process, limiting the initial attack surface. No active exploitation has been observed.
Weaknesses
- CWE-863Incorrect Authorization (opens in a new tab)
Class weaknessLikelihood of exploit: HighCWE Top 25 (2025): #17OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.