Description
Race condition in FileAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)
Published: 2026-09-09
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Site isolation bypass via race condition in Chrome FileAPI
Action: Immediate Patch
AI Analysis

Impact

A race condition in Chrome’s FileAPI lets a remote attacker who can already compromise the renderer process bypass the browser’s site isolation safeguards, potentially exposing data from other tabs or sites. The flaw a classic concurrency issue (CWE‑367) and is categorized as medium severity by Chromium security.

Affected Systems

All versions of Google Chrome prior to 153.0.8010.36 are vulnerable; newer releases contain the fix.

Risk and Exploitability

With a CVSS score of 8.8 and an EPSS score of <1%, the exploitability heavily relies on prior renderer compromise, which generally requires another vulnerability or user action. As the flaw is not listed in the CISA KEV catalog and no exploit libraries have been identified yet, the current risk is moderate.

Generated by OpenCVE AI on September 10, 2026 at 16:06 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Google Chrome to version 153.0.8010.36 or later.
  • Enable automatic Chrome updates or subscribe to the official security release channel for timely patching.
  • Follow safe browsing practices and use security extensions to reduce exposure to malicious sites.

Generated by OpenCVE AI on September 10, 2026 at 16:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4790-1 chromium security update
Debian DSA Debian DSA DSA-6506-1 chromium security update
History

Thu, 10 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Title FileAPI Race Condition Allows Site Isolation Bypass in Chrome
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 10 Sep 2026 14:00:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
Vendors & Products Google
Google chrome
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Wed, 09 Sep 2026 07:45:00 +0000

Type Values Removed Values Added
Title FileAPI Race Condition Allows Site Isolation Bypass in Chrome

Wed, 09 Sep 2026 01:00:00 +0000

Type Values Removed Values Added
Description Race condition in FileAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-367
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-09-10T15:35:47.095Z

Reserved: 2026-09-08T22:22:29.338Z

Link: CVE-2026-87433

cve-icon Vulnrichment

Updated: 2026-09-10T15:35:42.704Z

cve-icon NVD

Status : Modified

Published: 2026-09-09T01:16:59.450

Modified: 2026-09-10T16:18:04.310

Link: CVE-2026-87433

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-11T13:00:14Z

Weaknesses
  • CWE-367

    Time-of-check Time-of-use (TOCTOU) Race Condition