CVE-2026-87544 Details
Description
Incorrect authorization in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Low)
A vulnerability in Google Chrome Extensions prior to version 153.0.8010.36 allowed remote attackers to bypass system access restrictions and gain unauthorized access to a privileged page by using a crafted HTML page. This issue was rooted in incorrect authorization within the Extensions component.
Users can update to Google Chrome version 153.0.8010.36 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Sep 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html | [email protected] | Release NotesVendor Advisory |
| https://issues.chromium.org/issues/542355360 | [email protected] | Permissions Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| google chrome | < 153.0.8010.36 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 18, 2026 | CVE Modified | CISA-ADP |
| Sep 14, 2026 | CVE Modified | CISA-ADP |
| Sep 10, 2026 | Initial Analysis | [email protected] |
| Sep 9, 2026 | New CVE Received | [email protected] |