CVE-2026-87499

CVE-2026-87499 is an incorrect-authorization flaw (CWE-863) in the network component of Google Chrome that fails to properly enforce site isolation. It is triggered remotely when an attacker who has already compromised the browser's renderer process gets the user to load a crafted HTML page, allowing the compromised renderer to cross site-isolation boundaries. Successful exploitation lets the attacker access cross-origin data from other sites loaded in the same browser, undermining the isolation guarantee that normally confines a compromised renderer to one site; confidentiality and integrity are impacted while availability is not. Users running Google Chrome prior to version 153.0.8010.36 are affected. There are currently no known reports of exploitation in the wild, no public proof-of-concept, and EPSS estimates only a 0.2% chance of exploitation within 30 days.

What to do: Update Google Chrome to 153.0.8010.36 or later; verify the installed version at chrome://settings/help and confirm auto-updates are enabled. Note that exploitation requires a prior compromise of the renderer process, so this flaw is most likely chained with another browser bug rather than used standalone; patching removes it as a second stage in such attack chains.