CVE-2026-87570 is an authorization bypass vulnerability in Google Chrome's SiteIsolation feature affecting versions prior to 153.0.8010.36. A remote attacker who has already compromised the renderer process can exploit this flaw by using social engineering techniques and a specially crafted file to bypass site isolation, potentially allowing cross-site data access that SiteIsolation is designed to prevent. The vulnerability is categorized under CWE-863 (Incorrect Authorization). No CVSS score is provided, and no known exploits are reported in the wild.

The vulnerability could allow an attacker with control over the renderer process to bypass site isolation protections, potentially exposing data from other sites or processes that should be isolated. However, exploitation requires prior compromise of the renderer process and social engineering, which limits the attack surface. The Chromium security team rates this vulnerability as medium severity.

A fix is available in Google Chrome version 153.0.8010.36 and later. Users and administrators should update to this version or newer to remediate the vulnerability. No additional mitigation guidance is provided, and no known exploits are reported in the wild.