PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-87656 Google CVE debrief

CVE-2026-87656 is a MEDIUM-severity vulnerability in Google Chrome prior to version 153.0.8010.36, allowing a remote attacker to bypass system access restrictions via a crafted HTML page. The vulnerability has a CVSS score of 5.4 and is classified as CWE-754. This vulnerability affects Google Chrome deployments, and defenders should assess exposure and prioritize updating to version 153.0.8010.36 or later. The vulnerability's impact is related to improper state validation in Safebrowsing, which could lead to bypassing system access restrictions.

Vendor
Google
Product
Chrome
CVSS
MEDIUM 5.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-09
Original CVE updated
2026-09-14
Advisory published
2026-09-09
Advisory updated
2026-09-14

Who should care

Defenders responsible for managing Google Chrome deployments should assess exposure and prioritize updating to version 153.0.8010.36 or later.

Why it matters

CVE-2026-87656 is a MEDIUM-severity vulnerability in Google Chrome that allows a remote attacker to bypass system access restrictions. Defenders should prioritize verifying Chrome versions and updating to version 153.0.8010.36 or later to mitigate this vulnerability.

  • Defenders must verify Chrome versions to ensure they are not vulnerable.
  • System access restrictions may need to be reviewed and updated to prevent bypass attempts.
  • Monitoring for suspicious activity and potential bypass attempts is necessary.

Technical summary

The vulnerability is caused by improper state validation in Safebrowsing in Google Chrome prior to version 153.0.8010.36. This allows a remote attacker to bypass system access restrictions via a crafted HTML page. The vulnerability has a CVSS score of 5.4 and is classified as CWE-754. Defenders should prioritize verifying Chrome versions and updating to 153.0.8010.36 or later to mitigate this vulnerability.

Defensive priority

Defenders should prioritize verifying Chrome versions and updating to 153.0.8010.36 or later to mitigate this vulnerability.

Recommended defensive actions

  • Verify Chrome versions and update to 153.0.8010.36 or later
  • Review system access restrictions and ensure they are properly configured
  • Monitor for suspicious activity and potential bypass attempts

Evidence notes

The vulnerability is described in the CVE Program record and NVD vulnerability detail page. The Chrome release notes and issue tracker provide additional context.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-87656 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-87656

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-87656 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-87656

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.