CVE-2026-87584

CVE-2026-87584 is an incorrect authorization flaw (CWE-863) in the WebUI component of Google Chrome. A remote attacker can trigger it by luring a user into opening a crafted HTML page, which then allows bypassing system access restrictions to reach a privileged page in the browser. The attacker gains unauthorized access to privileged WebUI functionality, with high integrity impact per the CVSS vector (6.5, confidentiality and availability unaffected). All users running Google Chrome prior to 153.0.8010.36 are affected. No in-the-wild exploitation is confirmed: the flaw is absent from CISA's KEV catalog, EPSS assigns only a 0.2% 30-day exploitation probability, and the sole public reference is a Chromium issue-tracker entry.

What to do: Upgrade Google Chrome to version 153.0.8010.36 or later and enforce the update centrally via enterprise browser management policies; no workaround beyond updating has been published. Until patched, exercise caution with untrusted links and HTML pages, and verify managed fleets contain no browsers on versions before 153.0.8010.36.