Description
Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
Published: 2026-09-09
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized System Access
Action: Patch
AI Analysis

Impact

An improper state validation issue in Chrome's SafeBrowsing feature permits a remote attacker to craft an HTML page that, when opened in the browser, bypasses Chrome's system access restrictions. The flaw is linked to CWE‑754 and CWE‑79 and is classified by Chromium as a medium‑severity vulnerability.

Affected Systems

Google Chrome versions older than 153.0.8010.36 are affected. The vulnerability is presumed to target desktop installations of Chrome; this inference is drawn from the product description and the published desktop stable‑channel update that introduced the fix.

Risk and Exploitability

The flaw requires the victim to load a specifically crafted HTML page; no additional network or privilege prerequisites are listed. The EPSS score is under 1 %, indicating a low but non‑zero likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 5.4 signals medium severity. The likely attack vector is a user visiting or opening malicious HTML content in Chrome, after which the attacker may gain unauthorized system access depending on the browser’s access restrictions.

Generated by OpenCVE AI on September 9, 2026 at 14:45 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Google Chrome to version 153.0.8010.36 or later, which contains the state validation fix for SafeBrowsing.
  • If an immediate update is not possible, block or quarantine malicious HTML content using network or browser security controls, such as content filtering or site‑blocking proxies.
  • If necessary, temporarily disable the SafeBrowsing feature until a patch is available, noting that this reduces protection against other security threats.

Generated by OpenCVE AI on September 9, 2026 at 14:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4790-1 chromium security update
Debian DSA Debian DSA DSA-6506-1 chromium security update
History

Thu, 10 Sep 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 10 Sep 2026 14:15:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
Vendors & Products Google
Google chrome

Wed, 09 Sep 2026 12:15:00 +0000

Type Values Removed Values Added
Title Unvalidated State Bypass in Chrome Safebrowsing Enables Remote System Access chromium-browser: chromium-browser: Improper state validation in Safebrowsing
Weaknesses CWE-79
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N'}

threat_severity

Moderate

Wed, 09 Sep 2026 08:15:00 +0000

Type Values Removed Values Added
Title Unvalidated State Bypass in Chrome Safebrowsing Enables Remote System Access

Wed, 09 Sep 2026 01:00:00 +0000

Type Values Removed Values Added
Description Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-754
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-09-10T18:46:36.173Z

Reserved: 2026-09-08T22:43:54.074Z

Link: CVE-2026-87645

cve-icon Vulnrichment

Updated: 2026-09-10T18:45:34.142Z

cve-icon NVD

Status : Modified

Published: 2026-09-09T01:17:22.973

Modified: 2026-09-10T19:17:38.963

Link: CVE-2026-87645

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-09T00:09:44Z

Links: CVE-2026-87645 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-11T01:30:13Z

Weaknesses
  • CWE-754

    Improper Check for Unusual or Exceptional Conditions

  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')