CVE-2026-87541: Information leak in Google Chrome
Affects Google ChromeSource GCVE Database
Not known to be exploited · CVSS 6.5 Medium : monitor for a fix to Google Chrome.
Data as of 10/24/2026, 20:40:32 UTC
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 23% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
GitHubchromium/chromiumpkg:github/chromium/chromiumOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
A fix is available in Google Chrome version 153.0.8010.36. Users and administrators should update to this version or later to remediate the vulnerability. Since this is a client-side application, patching the browser is the recommended mitigation. No additional vendor advisory or patch links were provided; check official Google Chrome release notes for confirmation and updates.
Description
CVE-2026-87541 is an information leak vulnerability in Google Chrome's navigation component affecting versions prior to 153.0.8010.36. It allows a remote attacker who has already compromised the renderer process to bypass site isolation by using a crafted HTML page. The vulnerability has a medium severity rating with a CVSS score of 6.5.
Impact
The impact is an information leak that enables bypassing site isolation, potentially exposing sensitive data from other sites rendered in separate processes. However, exploitation requires prior compromise of the renderer process, which limits the attack surface. There is no indication of integrity or availability impact. The CVSS score of 6.5 reflects a medium severity level.
Summary
This vulnerability in Google Chrome (before version 153.0.8010.36) involves an information leak in the navigation subsystem. An attacker who has compromised the renderer process can exploit this flaw to bypass site isolation protections by crafting a malicious HTML page. Site isolation is a security feature designed to separate different websites into different processes to prevent data leakage between sites. The vulnerability is classified under CWE-200 (Exposure of Sensitive Information).
Weaknesses
- CWE-200Exposure of Sensitive Information to an Unauthorized Actor (opens in a new tab)
Class weaknessLikelihood of exploit: HighCWE Top 25 (2025): #20OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
MITRE discourages mapping vulnerabilities to this broad entry; the root cause is usually a more specific weakness.