CVE-2026-87560 in Chrome
Summary
by MITRE • 09/09/2026
Missing authorization in Browser in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as missing authorization within the browser component of Google Chrome, specifically in versions prior to 153.0.8010.36, represents a critical failure in enforcing access control policies for system resources. This flaw allows a remote attacker to bypass intended security restrictions by leveraging a specially crafted HTML page. The core issue lies in the browser's handling of authorization checks when interacting with certain APIs or internal systems that require elevated privileges. Instead of validating whether the executing context has the necessary permissions, the browser proceeds with the operation, effectively treating untrusted web content as if it possessed higher-level system access rights than intended by the security architecture.
From a technical perspective, this vulnerability falls under the category of Improper Access Control, which is formally classified in the Common Weakness Enumeration (CWE) database as CWE-269. This type of weakness occurs when an actor can act with unauthorized privileges or perform actions that should be restricted to authorized users or processes. In the context of a web browser, this often involves bypassing same-origin policies or accessing sensitive APIs such as those related to device management, file system access, or hardware interfaces without proper user consent or authentication verification. The attacker exploits this by embedding malicious code within an HTML page that triggers these vulnerable functions, causing the browser to execute commands on behalf of the untrusted source.
The operational impact of this vulnerability is significant because it enables remote code execution scenarios where the scope of compromise extends beyond typical web sandboxing boundaries. By bypassing system access restrictions, a remote attacker can potentially read sensitive data stored locally by the user, modify application settings, or interact with connected hardware devices in ways that were not intended for public-facing websites. This undermines the fundamental trust model of the browser, which relies on strict isolation between untrusted web content and local system resources. The severity is rated as Medium because while it allows bypassing restrictions, successful exploitation typically requires user interaction such as visiting a malicious site or clicking a link, rather than being fully automatic through passive browsing alone.
This type of attack aligns with tactics observed in the MITRE ATT&CK framework, particularly those involving Initial Access and Execution phases where adversaries use crafted web content to gain footholds on target systems. The technique resembles Drive-by Code Execution, where visiting a compromised or maliciously constructed website leads to unauthorized actions being performed by the browser software itself. Defenders must recognize that even medium-severity vulnerabilities in core components like browsers can serve as entry points for more complex attack chains if left unpatched.
To mitigate this risk, organizations and individual users should ensure that Google Chrome is updated to version 153.0.8010.36 or later immediately upon availability. This patch addresses the authorization logic flaw by enforcing stricter checks before allowing web content to interact with restricted system APIs. Additionally, implementing browser hardening techniques such as disabling unnecessary plugins and using extensions that restrict API access can provide an additional layer of defense. Security awareness training is also crucial to help users identify suspicious links or websites that might attempt to exploit this vulnerability through social engineering tactics designed to lure them into visiting the crafted HTML pages described in the advisory.