Description
Incorrect authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted PDF file. (Chromium security severity: Medium)
Published: 2026-09-09
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation via Site Isolation Bypass
Action: Immediate Patch
AI Analysis

Impact

The vulnerability arises from incorrect authorization controls in Chrome’s FileSystem API, which allow a remote attacker who has compromised the renderer process to bypass site isolation when a crafted PDF is opened. This flaw (CWE-863) may enable access to resources belonging to other sites or contexts within the browser.

Affected Systems

Google Chrome installations running a version earlier than 153.0.8010.36 are affected. The flaw manifests when a malicious PDF is opened after the renderer process is compromised.

Risk and Exploitability

The CVSS base score of 8.1 indicates high severity. Exploitation requires a prior compromise of the renderer process, typically via a malicious PDF file. The EPSS score of <1% indicates a very low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Consequently, systems that keep Chrome updated face moderate overall risk, while those that process untrusted PDFs or run outdated Chrome versions are at higher risk.

Generated by OpenCVE AI on September 10, 2026 at 19:11 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Google Chrome to version 153.0.8010.36 or later or any newer release.
  • If an immediate upgrade is not feasible, restrict opening PDFs from untrusted sources or disable the built‑in PDF viewer in Chrome.
  • Maintain the Chrome installation by applying all future security updates promptly.

Generated by OpenCVE AI on September 10, 2026 at 19:11 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4790-1 chromium security update
Debian DSA Debian DSA DSA-6506-1 chromium security update
History

Thu, 10 Sep 2026 19:30:00 +0000

Type Values Removed Values Added
Title Bypass of Site Isolation via PDF in Chrome Through FileSystem Authorization Flaw
First Time appeared Google
Google chrome
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
Vendors & Products Google
Google chrome

Thu, 10 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 09 Sep 2026 06:00:00 +0000

Type Values Removed Values Added
Title Bypass of Site Isolation via PDF in Chrome Through FileSystem Authorization Flaw

Wed, 09 Sep 2026 01:00:00 +0000

Type Values Removed Values Added
Description Incorrect authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted PDF file. (Chromium security severity: Medium)
Weaknesses CWE-863
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-09-10T14:10:23.903Z

Reserved: 2026-09-08T22:39:03.061Z

Link: CVE-2026-87505

cve-icon Vulnrichment

Updated: 2026-09-10T14:09:16.742Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-09T01:17:07.473

Modified: 2026-09-10T19:23:56.697

Link: CVE-2026-87505

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-11T01:00:08Z

Weaknesses