PatchSiren cyber security CVE debrief

CVE-2026-87584 Google CVE debrief

CVE-2026-87584 is an incorrect authorization vulnerability in Google Chrome's WebUI. The vulnerability allowed a remote attacker to bypass system access restrictions via a crafted HTML page. It has a CVSS score of 6.5 and is classified as Medium severity. Defenders should assess exposure and prioritize patching to prevent potential unauthorized access. The vulnerability affects Google Chrome's WebUI, which is a privileged page that requires proper authorization. The incorrect authorization allows an attacker to bypass system access restrictions, potentially leading to unauthorized access.

Vendor: Google
Product: Chrome
CVSS: MEDIUM 6.5
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-09-09
Original CVE updated: 2026-09-11
Advisory published: 2026-09-09
Advisory updated: 2026-09-11

Who should care

Defenders responsible for Google Chrome deployments should assess exposure and prioritize patching to prevent potential unauthorized access.

Why it matters

CVE-2026-87584 is a Medium-severity vulnerability in Google Chrome's WebUI that allows remote attackers to bypass system access restrictions. Defenders should prioritize verifying and applying the patch to prevent potential unauthorized access.

Potential unauthorized access to privileged pages
Bypassing of system access restrictions
Possible elevation of privileges

Technical summary

The vulnerability is caused by incorrect authorization in Google Chrome's WebUI, allowing a remote attacker to bypass system access restrictions via a crafted HTML page. The vulnerability affects Google Chrome's WebUI, which is a privileged page that requires proper authorization. The incorrect authorization allows an attacker to bypass system access restrictions, potentially leading to unauthorized access. The vendor has provided a patch and release notes to address the vulnerability.

Defensive priority

Defenders should prioritize verifying and applying the patch to prevent potential unauthorized access.

Recommended defensive actions

Verify and apply the patch to Google Chrome
Monitor for potential unauthorized access attempts
Review system access restrictions and update as necessary

Evidence notes

The vulnerability is confirmed by the CVE Program and NVD records. Google has provided a patch and release notes. The CVE record was published on 2026-09-09T01:17:16.257Z. Defenders should verify and apply the patch to prevent potential unauthorized access. The vendor advisory and release notes provide additional information on the vulnerability and the patch.

Sources and references

Verified primary and authoritative sources

CVE-2026-87584 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-87584

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-87584 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-87584

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source reference
Unverified legacy reference

URL: https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html

[email protected] - Vendor Advisory, Release Notes
Source reference
Unverified legacy reference

URL: https://issues.chromium.org/issues/537466493

[email protected] - Exploit, Issue Tracking, Patch

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.