CVE-2026-87468 in Chrome
Summary
by MITRE • 09/09/2026
Incorrect authorization in Isolated in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as an incorrect authorization issue within the Chromium-based browser engine, specifically affecting Google Chrome versions prior to 153.0.8010.36, represents a critical failure in the implementation of site isolation mechanisms. Site isolation is a fundamental security architecture designed to prevent cross-site scripting and data theft by ensuring that each website runs in its own unique process with isolated memory space. This architectural boundary prevents malicious scripts from one origin from accessing sensitive data belonging to another origin, such as authentication tokens or personal information stored via cookies or local storage. The flaw described indicates a breakdown in the authorization checks performed during the handling of navigation requests and resource loading, allowing a remote attacker to circumvent these isolation boundaries through a specially crafted HTML page.
From a technical perspective, this vulnerability likely stems from an improper validation of origin headers or permissions when establishing cross-origin frames or navigating between different security contexts. In modern browsers, site isolation relies on strict enforcement policies that verify the requesting entity's identity against established trust relationships and policy definitions. When these checks are bypassed due to incorrect authorization logic, the browser may inadvertently grant a malicious page access to resources or data from a trusted but distinct origin. This effectively collapses the security boundary intended by the sandbox model, allowing code executed in one context to interact with memory or state belonging to another, which is precisely what site isolation aims to prevent.
The operational impact of this vulnerability is significant for users who rely on Chrome for handling sensitive online activities such as banking, email access, and corporate logins. An attacker could exploit this flaw by hosting a malicious webpage that tricks a victim into visiting it while they are logged into other services in separate tabs or frames. By bypassing site isolation, the attacker's script could potentially read cookies, local storage data, or DOM content from those trusted sites without triggering standard same-origin policy errors. This capability facilitates sophisticated cross-site request forgery attacks, session hijacking, and unauthorized access to private user information, undermining the confidentiality and integrity of web applications that depend on browser-enforced isolation for security.
This type of vulnerability is commonly classified under CWE-269, which refers to Improper Authorization, as it involves a failure to enforce proper permissions before allowing an action or data access. In terms of offensive security frameworks like MITRE ATT&CK, this flaw aligns with techniques related to Browser Security Misconfiguration and potentially Cross-Site Scripting if the isolation breach allows for script injection across origins. The severity is rated as medium by Chromium because while it does not allow direct arbitrary code execution on the host system, it significantly weakens the browser's primary defense against web-based attacks that target user data privacy.
To mitigate this risk, users must ensure they are running Google Chrome version 153.0.8010.36 or later, where these authorization checks have been corrected and site isolation enforcement has been hardened. Administrators should enforce automatic update policies to prevent exposure to known browser vulnerabilities for extended periods. Additionally, while technical patches address the root cause, users can further reduce risk by employing additional security layers such as strict content security policies on their own websites, using multi-factor authentication to limit the value of stolen session tokens, and avoiding the mixing of sensitive and untrusted web activities within the same browsing profile when possible.