CVE-2026-87447

CVE-2026-87447 is an incorrect authorization flaw (CWE-863) in the Network component of Google Chrome that lets the browser's web origin policy — the isolation boundary between websites — be bypassed. A remote attacker triggers it by using social engineering to convince a user to install or interact with a crafted Chrome extension, which then exploits the flawed authorization checks. The attacker gains the ability to circumvent origin-based isolation, which the CVSS scoring characterizes as an integrity impact (C:N/I:H/A:N — no confidentiality or availability loss is scored). All Google Chrome users running versions prior to 153.0.8010.36 are affected; Google rated the flaw High under the Chromium security severity scheme. There is no confirmed in-the-wild exploitation so far: the issue is not on CISA KEV, EPSS estimates only a 0.3% probability of exploitation within 30 days (21st percentile), and one public proof-of-concept reference exists on the Chromium issue tracker.

What to do: Update Google Chrome to 153.0.8010.36 or later and verify via chrome://settings/help (or chrome://version), relaunching the browser so the auto-update takes effect. Until patched, enterprises can reduce risk by restricting extension installation via allowlist/blocklist policies, since exploitation depends on social engineering plus a crafted extension. Track the linked Chromium issue (issues.chromium.org/issues/503464711) for updates; the flaw is not currently on CISA KEV.