CVE-2026-87580 Google CVE debrief

Who should care

Defenders who manage Google Chrome deployments should assess exposure and prioritize updating to version 153.0.8010.36 or later. Additionally, users who interact with Google Chrome should be educated about the risks of social engineering and the importance of being cautious when interacting with crafted HTML pages.

Why it matters

CVE-2026-87580 is a medium-severity vulnerability in Google Chrome that allows a remote attacker to bypass site isolation via social engineering. Defenders should prioritize updating Google Chrome and educating users about social engineering risks.

• Defenders need to verify if their Google Chrome deployments are updated to version 153.0.8010.36 or later.
• Defenders should educate users about the risks of social engineering and the importance of being cautious when interacting with crafted HTML pages.
• Defenders need to implement additional security measures to prevent social engineering attacks.

Technical summary

The vulnerability is caused by incorrect authorization in WebAppInstalls in Google Chrome prior to version 153.0.8010.36. This allows a remote attacker who has compromised the renderer process and leveraged social engineering to bypass site isolation via a crafted HTML page. Defenders should prioritize updating Google Chrome to version 153.0.8010.36 or later to mitigate this vulnerability. Additionally, defenders should educate users about the risks of social engineering and the importance of being cautious when interacting with crafted HTML pages.

Defensive priority

Defenders should prioritize updating Google Chrome to version 153.0.8010.36 or later to mitigate this vulnerability. Additionally, defenders should educate users about the risks of social engineering and the importance of being cautious when interacting with crafted HTML pages.

Recommended defensive actions

• Update Google Chrome to version 153.0.8010.36 or later
• Educate users about the risks of social engineering
• Implement additional security measures to prevent social engineering attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD vulnerability detail provide information about the incorrect authorization vulnerability in WebAppInstalls in Google Chrome. The vendor advisory and release notes provide additional context about the vulnerability and the available patch.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.