Race condition in Browser in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML… (CVE-2026-87641)
Source GCVE Database
Not known to be exploited.
Data as of 10/25/2026, 04:40:14 UTC
CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 7% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
What to do
AI-suggested
Until an official fix is released, users should exercise caution when browsing untrusted websites and consider applying any available Chrome updates promptly once published.
Description
A race condition vulnerability in the Browser component of Google Chrome versions prior to 153.0.8010.36 allows a remote attacker to bypass system access restrictions by delivering a crafted HTML page. The vulnerability is rated medium severity by Chromium security. No public exploits or patches are currently known.
Impact
Successful exploitation could allow a remote attacker to bypass system access restrictions, potentially leading to unauthorized actions within the browser context. However, no known exploits are currently active in the wild, and the impact is rated medium severity.
Weaknesses
- CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') (opens in a new tab)
Class weaknessLikelihood of exploit: MediumOWASP Top 10 A06:2025: Insecure Design (opens in a new tab)
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.