CVE-2026-87610

Analyzed Analyzed - Analysis Complete

Incorrect Authorization in Google Chrome Omnibox

Publication date: 2026-09-09

Last updated on: 2026-09-11

Assigner: Chrome

Description

Incorrect authorization in Omnibox in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Medium)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-11

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-87610

EUVD

EUVD-2026-74428

Affected Vendors & Products

Vendor	Product	Version / Range
google	chrome	to 153.0.8010.36 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability involves incorrect authorization in the Omnibox feature of Google Chrome before version 153.0.8010.36. A remote attacker could exploit this by crafting a malicious HTML page to bypass system access restrictions and access privileged pages.

Detection Guidance

This vulnerability involves incorrect authorization in Google Chrome's Omnibox feature. Detection primarily requires checking the installed version of Google Chrome. If your version is prior to 153.0.8010.36, the system is vulnerable. Use the command 'google-chrome --version' on Linux or check 'chrome://settings/help' in the browser to verify the version.

Impact Analysis

If exploited, this vulnerability could allow an attacker to gain unauthorized access to sensitive pages or data within Chrome, potentially leading to data theft, unauthorized actions, or further compromise of the user's system.

Compliance Impact

This vulnerability allows unauthorized access to privileged pages via crafted HTML, which could lead to data exposure or unauthorized actions. Such breaches may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information if exploited in systems handling regulated data.

Mitigation Strategies

Update Google Chrome to version 153.0.8010.36 or later to address the incorrect authorization issue in Omnibox.

Hi! I’m here to help you understand CVE-2026-87610. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70