Description
Missing authorization in Browser in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
Published: 2026-09-09
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation
Action: Update Browser
AI Analysis

Impact

A missing authorization flaw in Google Chrome’s browser allows a remote attacker to bypass system access restrictions by serving a crafted HTML page. The vulnerability is a classic example of improper authorization (CWE‑862) and can lead to unauthorized control over system resources if exploited.

Affected Systems

The issue affects all Chrome desktop releases prior to version 153.0.8010.36, regardless of operating system or build. Users running these versions are susceptible until they upgrade to a patched build.

Risk and Exploitability

The CVSS score is 4.3, EPSS score < 1%, and the vulnerability is not listed in the CISA KEV catalog. The Chromium project rates the severity as Medium. The attack vector is inferred to be remote – a malicious web page can be served to the victim’s browser, allowing the attacker to elevate privileges by tricking the user into loading the content.

Generated by OpenCVE AI on September 9, 2026 at 23:09 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Google Chrome to version 153.0.8010.36 or newer via the built‑in update mechanism
  • Ensure automatic updates are enabled so future patches are applied without manual intervention
  • If an immediate update cannot be performed, restrict site capabilities that allow system access by configuring Chrome policies to disable or limit affected APIs

Generated by OpenCVE AI on September 9, 2026 at 23:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4790-1 chromium security update
Debian DSA Debian DSA DSA-6506-1 chromium security update
History

Thu, 10 Sep 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 09 Sep 2026 23:30:00 +0000

Type Values Removed Values Added
Title Chrome Browser Authorization Bypass via Crafted HTML Page

Wed, 09 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
Vendors & Products Google
Google chrome
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'}

Wed, 09 Sep 2026 01:00:00 +0000

Type Values Removed Values Added
Description Missing authorization in Browser in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-862
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-09-10T18:18:50.968Z

Reserved: 2026-09-08T22:40:40.338Z

Link: CVE-2026-87560

cve-icon Vulnrichment

Updated: 2026-09-10T18:18:31.259Z

cve-icon NVD

Status : Modified

Published: 2026-09-09T01:17:13.657

Modified: 2026-09-10T19:17:38.480

Link: CVE-2026-87560

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-10T12:15:16Z

Weaknesses