CVE-2026-87493

CVE-2026-87493 is a missing-authorization flaw (CWE-862) in the FileSystem component of Google Chrome, rated Medium severity by Chromium. A remote attacker can trigger it by using social engineering to lure a user into opening a crafted HTML page, with user interaction required before the flaw is reached. Successful exploitation bypasses system access restrictions on the filesystem, and the CVSS scoring indicates the practical impact is a high loss of integrity (unauthorized changes) with no confidentiality or availability impact. Any user running Google Chrome prior to 153.0.8010.36 is affected. A public proof-of-concept is available via the Chromium issue tracker, but exploitation probability is low (EPSS 0.2%) and the flaw is not in the CISA KEV catalog, with no confirmed in-the-wild attacks reported.

What to do: Update Google Chrome to 153.0.8010.36 or later (via Help > About Google Chrome, or your enterprise update channel) and verify fleet versions through browser management tooling. Until patched, caution users against opening untrusted HTML pages and be wary of unexpected file-system permission prompts. Given the low EPSS score and Medium severity, this can be handled in the normal patch cycle rather than as an emergency.