CVE-2026-87577

CVE-2026-87577 is an incorrect authorization flaw (CWE-863) in the Isolated component of Google Chrome, fixed in version 153.0.8010.36. A remote attacker triggers it by persuading a user to open a crafted HTML page, since the CVSS vector requires user interaction (UI:R). On success, the attacker bypasses web origin policy to gain access into a privileged page, with limited confidentiality impact (CVSS 4.3 Medium, C:L/I:N/A:N). Any user running Chrome prior to 153.0.8010.36 is affected. There is no evidence of in-the-wild exploitation — it is not in CISA KEV and EPSS assigns a 0.2% 30-day exploitation probability (9th percentile) — but one public proof-of-concept reference exists in the Chromium issue tracker.

What to do: Update Google Chrome to 153.0.8010.36 or later (verify via Settings > About Chrome, and enforce the fixed version through enterprise update management for managed fleets). The attack requires user interaction, so standard user-vigilance around untrusted web content applies; given Medium severity, absent KEV listing, and low EPSS, routine patching cadence is sufficient.