CVE-2026-87447

Analyzed Analyzed - Analysis Complete

Incorrect Authorization Bypass in Google Chrome

Publication date: 2026-09-09

Last updated on: 2026-09-10

Assigner: Chrome

Description

Incorrect authorization in Network in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: High)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-10

Generated

2026-09-29

AI Q&A

2026-09-09

EPSS Evaluated

2026-09-27

NVD

CVE-2026-87447

EUVD

EUVD-2026-74489

Affected Vendors & Products

Vendor	Product	Version / Range
google	chrome	to 153.0.8010.36 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability involves incorrect authorization in Google Chrome before version 153.0.8010.36. A remote attacker could bypass web origin policy by tricking a user into installing a malicious Chrome extension through social engineering tactics.

Detection Guidance

This vulnerability involves incorrect authorization in Google Chrome due to a flaw in web origin policy handling via crafted extensions. Detection requires checking Chrome versions and inspecting installed extensions for suspicious activity. No specific commands are provided in the context.

Impact Analysis

If exploited, this flaw could allow an attacker to bypass security restrictions, potentially accessing sensitive data or performing unauthorized actions on behalf of the user. Social engineering is required, meaning users must be deceived into installing the malicious extension.

Compliance Impact

The vulnerability allows unauthorized access to network resources due to incorrect authorization, which could lead to data exposure or manipulation. This may violate compliance requirements under GDPR (data protection) and HIPAA (health data privacy) by enabling unauthorized access to sensitive information.

Mitigation Strategies

Update Google Chrome to version 153.0.8010.36 or later to address the incorrect authorization issue. Remove any untrusted or suspicious Chrome extensions that may have been installed.

Hi! I’m here to help you understand CVE-2026-87447. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70