CVE-2026-87549

Modified Modified - Updated After Analysis

Chrome Downloads Incomplete Cleanup Security Bypass

Publication date: 2026-09-09

Last updated on: 2026-09-10

Assigner: Chrome

Description

Incomplete cleanup in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-10

Generated

2026-09-29

AI Q&A

2026-09-09

EPSS Evaluated

2026-09-27

NVD

CVE-2026-87549

EUVD

EUVD-2026-74376

Affected Vendors & Products

Vendor	Product	Version / Range
google	chrome	to 153.0.8010.36 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-459	The product does not properly "clean up" and remove temporary or supporting resources after they have been used.

Attack-Flow Graph

Executive Summary

This vulnerability involves incomplete cleanup in the Downloads feature of Google Chrome before version 153.0.8010.36. A remote attacker could exploit this by using social engineering tactics to trick a user into visiting a specially crafted HTML page, which could bypass system access restrictions.

Detection Guidance

This vulnerability involves incomplete cleanup in Google Chrome's Downloads feature. Detection primarily involves checking Chrome version and monitoring for suspicious download behavior. Verify Chrome version is 153.0.8010.36 or later. If using Linux/macOS, run: chrome --version. For Windows, check via chrome://settings/help or Programs and Features. No specific commands detect exploitation directly.

Impact Analysis

This vulnerability could allow an attacker to bypass system access restrictions on your device. If exploited, it might enable unauthorized actions or access to sensitive data through social engineering techniques like deceptive web pages.

Compliance Impact

This vulnerability involves incomplete cleanup in Google Chrome's Downloads feature, enabling a remote attacker to bypass system access restrictions through social engineering. While the description does not explicitly link this to compliance standards, such vulnerabilities could potentially impact GDPR by compromising user data access controls or HIPAA by affecting secure data handling in healthcare contexts. However, specific compliance impacts are not detailed in the provided text.

Mitigation Strategies

Update Google Chrome to version 153.0.8010.36 or later to address the incomplete cleanup issue in Downloads.

Hi! I’m here to help you understand CVE-2026-87549. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70