PatchSiren cyber security CVE debrief
CVE-2026-87610 Google CVE debrief
CVE-2026-87610 is a Medium-severity vulnerability in Google Chrome's Omnibox feature, allowing remote attackers to bypass system access restrictions via a crafted HTML page. The CVE record was published on 2026-09-09T01:17:19.097Z and was last modified on 2026-09-11T13:57:46.783Z. The NVD entry is currently Analyzed. Defenders responsible for Google Chrome deployments should assess exposure and prioritize patching to prevent potential unauthorized access. The vulnerability is caused by incorrect authorization in Omnibox, allowing attackers to bypass system access restrictions via a crafted HTML page. Further verification is needed to determine the full scope of affected systems.
- Vendor
- Product
- Chrome
- CVSS
- MEDIUM 6.5
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-09-09
- Original CVE updated
- 2026-09-11
- Advisory published
- 2026-09-09
- Advisory updated
- 2026-09-11
Who should care
Defenders responsible for Google Chrome deployments should assess exposure and prioritize patching to prevent potential unauthorized access.
Why it matters
CVE-2026-87610 is a Medium-severity vulnerability in Google Chrome's Omnibox feature, allowing remote attackers to bypass system access restrictions via a crafted HTML page. Defenders should prioritize verifying and applying the patch to prevent potential unauthorized access.
- Potential unauthorized access to privileged pages
- Need to verify and apply the patch to prevent exploitation
- Possible impact on system access restrictions
Technical summary
The vulnerability is caused by incorrect authorization in Omnibox, allowing attackers to bypass system access restrictions via a crafted HTML page. The CVE record and NVD entry provide details on the vulnerability, but further verification is needed to determine the full scope of affected systems.
Defensive priority
Defenders should prioritize verifying and applying the patch to prevent potential unauthorized access.
Recommended defensive actions
- Verify and apply the patch to Google Chrome
- Monitor system access restrictions for potential unauthorized access
- Review and update incident response plans
Evidence notes
The vulnerability is caused by incorrect authorization in Omnibox, allowing attackers to bypass system access restrictions. The CVE record and NVD entry provide details on the vulnerability, but further verification is needed to determine the full scope of affected systems.
Sources and references
Verified primary and authoritative sources
-
CVE-2026-87610 CVE Program record
Publisher, destination, and source semantics verified
URL: https://www.cve.org/CVERecord?id=CVE-2026-87610
CVE Program - Official CVE Program record with source-provided CVE metadata.
-
CVE-2026-87610 NVD vulnerability detail
Publisher, destination, and source semantics verified
URL: https://nvd.nist.gov/vuln/detail/CVE-2026-87610
NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.
Supplemental references
-
Source reference
Unverified legacy reference
URL: https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html
[email protected] - Vendor Advisory, Release Notes
-
Source reference
Unverified legacy reference
URL: https://issues.chromium.org/issues/547592631
[email protected] - Permissions Required
Methodology and review provenance
AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.