PatchSiren cyber security CVE debrief

CVE-2026-87589 Google CVE debrief

CVE-2026-87589 is an incorrect authorization vulnerability in SiteIsolation in Google Chrome prior to 153.0.8010.36. A remote attacker who has compromised the renderer process can bypass system access restrictions via a crafted HTML page. The vulnerability has a CVSS score of 6.5 and a severity of Medium. This vulnerability affects Google Chrome deployments and requires immediate attention from defenders to assess exposure and prioritize updates. The vulnerability allows remote attackers to bypass system access restrictions, which can lead to unauthorized access to sensitive information.

Vendor: Google
Product: Chrome
CVSS: MEDIUM 6.5
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-09-09
Original CVE updated: 2026-09-11
Advisory published: 2026-09-09
Advisory updated: 2026-09-11

Who should care

Defenders responsible for managing Google Chrome deployments should assess exposure and prioritize updates to address the vulnerability. This includes IT administrators, security teams, and vulnerability management teams who need to ensure that Google Chrome is updated to version 153.0.8010.36 or later to prevent exploitation.

Why it matters

CVE-2026-87589 is a Medium-severity vulnerability in Google Chrome that allows remote attackers to bypass system access restrictions. Defenders should prioritize updates to address the vulnerability.

Remote attackers may bypass system access restrictions
Defenders must update Google Chrome to version 153.0.8010.36 or later
System access restrictions may be compromised

Technical summary

The vulnerability is caused by incorrect authorization in SiteIsolation in Google Chrome prior to 153.0.8010.36. A remote attacker who has compromised the renderer process can bypass system access restrictions via a crafted HTML page. This vulnerability is a result of improper authorization checks in the SiteIsolation feature of Google Chrome, which can be exploited by attackers to gain unauthorized access.

Defensive priority

Defenders should prioritize updating Google Chrome to version 153.0.8010.36 or later to address the incorrect authorization vulnerability.

Recommended defensive actions

Update Google Chrome to version 153.0.8010.36 or later
Review system access restrictions and ensure they are properly configured
Monitor for suspicious activity related to the vulnerability

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the vulnerability, including its description, CVSS score, and affected versions.

Sources and references

Verified primary and authoritative sources

CVE-2026-87589 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-87589

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-87589 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-87589

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source reference
Unverified legacy reference

URL: https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html

[email protected] - Vendor Advisory, Release Notes
Source reference
Unverified legacy reference

URL: https://issues.chromium.org/issues/518002426

[email protected] - Exploit, Issue Tracking, Patch

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.