CVE-2026-87580 Details
Description
Incorrect authorization in WebAppInstalls in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)
A vulnerability in Google Chrome's WebAppInstalls component, present in versions prior to 153.0.8010.36, allows a remote attacker to bypass site isolation. This is achieved by compromising the renderer process and using social engineering to exploit the vulnerability. The attacker can navigate iframes across different Isolated Web Apps (IWAs), bypassing Content Security Policy (CSP) checks, and manipulate Service Worker events, creating a cross-IWA blind Cross-Site Request Forgery (CSRF) attack. Additionally, the attacker can probe the installation status of IWAs, using the information to inform future attacks.
The vulnerability has been fixed in Google Chrome version 153.0.8010.36. Users should update to this version to address the issue.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Sep 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html | [email protected] | Vendor AdvisoryRelease Notes |
| https://issues.chromium.org/issues/502986244 | [email protected] | ExploitIssue TrackingPatch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| google chrome | < 153.0.8010.36 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 11, 2026 | Initial Analysis | [email protected] |
| Sep 10, 2026 | CVE Modified | CISA-ADP |
| Sep 9, 2026 | New CVE Received | [email protected] |