{"id":"CVE-2026-87575","title":"Incorrect authorization in Loader in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page","summary":"Incorrect authorization in Loader in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","cwe":["CWE-863"],"vendor":"google","product":"chrome","affected":["chrome < 153.0.8010.36"],"patched":["chrome 153.0.8010.36"],"published":"2026-09-09","updated":"2026-09-14","sourceUpdated":"2026-09-14T13:18:59.007","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87575","references":[{"url":"https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html","label":"chrome-cve-admin@google.com"},{"url":"https://issues.chromium.org/issues/540013886","label":"chrome-cve-admin@google.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-87575.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-87575"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-87575"}],"tags":["nvd","cve.org","exploit-available","csaf","vex","red-hat"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-14T12:46:14.510238Z"},"epss":0.00219,"epssPercentile":0.12296,"exploits":{"github":1,"githubRepos":["https://github.com/SneakyNachos/CVE-2026-87575-CVE-2026-87606-CVE-2026-87491-and-CVE-2026-85046.-Escape-the-v8-carcass."],"checkedAt":"2026-10-27T19:19:40.967Z"},"exploitAvailable":true,"ingestedAt":"2026-09-09T01:17:17.505Z","scores":{"nvd":5.4,"vendor":4.3},"slug":"CVE-2026-87575","body":"## Overview\n\nIncorrect authorization in Loader in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)\n\n## Affected\n\n- `chrome < 153.0.8010.36`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `chrome 153.0.8010.36`\n\n## Vendor advisories\n\n- **Red Hat VEX** · updated 2026-09-25 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-87575.json)","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":29.7,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":202461,"id":"CVE-2026-87575","ts":1789400077015,"field":"exploit_available","old":"false","new":"true"},{"seq":202460,"id":"CVE-2026-87575","ts":1789400077015,"field":"cvss","old":null,"new":"5.4"},{"seq":202459,"id":"CVE-2026-87575","ts":1789400077015,"field":"severity","old":"none","new":"medium"},{"seq":201188,"id":"CVE-2026-87575","ts":1789397620234,"field":"exploit_available","old":"true","new":"false"},{"seq":201187,"id":"CVE-2026-87575","ts":1789397620234,"field":"cvss","old":"5.4","new":null},{"seq":201186,"id":"CVE-2026-87575","ts":1789397620234,"field":"severity","old":"medium","new":"none"},{"seq":199881,"id":"CVE-2026-87575","ts":1789395578189,"field":"exploit_available","old":"false","new":"true"},{"seq":199880,"id":"CVE-2026-87575","ts":1789395578189,"field":"cvss","old":null,"new":"5.4"},{"seq":199879,"id":"CVE-2026-87575","ts":1789395578189,"field":"severity","old":"none","new":"medium"},{"seq":199122,"id":"CVE-2026-87575","ts":1789392260303,"field":"exploit_available","old":"true","new":"false"},{"seq":199121,"id":"CVE-2026-87575","ts":1789392260303,"field":"cvss","old":"5.4","new":null},{"seq":199120,"id":"CVE-2026-87575","ts":1789392260303,"field":"severity","old":"medium","new":"none"},{"seq":197455,"id":"CVE-2026-87575","ts":1789384296845,"field":"exploit_available","old":"false","new":"true"},{"seq":197454,"id":"CVE-2026-87575","ts":1789384296845,"field":"cvss","old":null,"new":"5.4"},{"seq":197453,"id":"CVE-2026-87575","ts":1789384296845,"field":"severity","old":"none","new":"medium"},{"seq":196729,"id":"CVE-2026-87575","ts":1789383772970,"field":"exploit_available","old":"true","new":"false"},{"seq":196728,"id":"CVE-2026-87575","ts":1789383772970,"field":"cvss","old":"5.4","new":null},{"seq":196727,"id":"CVE-2026-87575","ts":1789383772970,"field":"severity","old":"medium","new":"none"},{"seq":195633,"id":"CVE-2026-87575","ts":1789380578221,"field":"exploit_available","old":"false","new":"true"},{"seq":195632,"id":"CVE-2026-87575","ts":1789380578221,"field":"cvss","old":null,"new":"5.4"},{"seq":195631,"id":"CVE-2026-87575","ts":1789380578221,"field":"severity","old":"none","new":"medium"},{"seq":194584,"id":"CVE-2026-87575","ts":1789378789456,"field":"exploit_available","old":"true","new":"false"},{"seq":194583,"id":"CVE-2026-87575","ts":1789378789456,"field":"cvss","old":"5.4","new":null},{"seq":194582,"id":"CVE-2026-87575","ts":1789378789456,"field":"severity","old":"medium","new":"none"},{"seq":193371,"id":"CVE-2026-87575","ts":1789376520876,"field":"exploit_available","old":"false","new":"true"},{"seq":193370,"id":"CVE-2026-87575","ts":1789376520876,"field":"cvss","old":null,"new":"5.4"},{"seq":193369,"id":"CVE-2026-87575","ts":1789376520876,"field":"severity","old":"none","new":"medium"},{"seq":192158,"id":"CVE-2026-87575","ts":1789373639263,"field":"exploit_available","old":"true","new":"false"},{"seq":192157,"id":"CVE-2026-87575","ts":1789373639263,"field":"cvss","old":"5.4","new":null},{"seq":192156,"id":"CVE-2026-87575","ts":1789373639263,"field":"severity","old":"medium","new":"none"},{"seq":190943,"id":"CVE-2026-87575","ts":1789369487848,"field":"exploit_available","old":"false","new":"true"},{"seq":190942,"id":"CVE-2026-87575","ts":1789369487848,"field":"cvss","old":null,"new":"5.4"},{"seq":190941,"id":"CVE-2026-87575","ts":1789369487848,"field":"severity","old":"none","new":"medium"},{"seq":189730,"id":"CVE-2026-87575","ts":1789368460838,"field":"exploit_available","old":"true","new":"false"},{"seq":189729,"id":"CVE-2026-87575","ts":1789368460838,"field":"cvss","old":"5.4","new":null},{"seq":189728,"id":"CVE-2026-87575","ts":1789368460838,"field":"severity","old":"medium","new":"none"},{"seq":188513,"id":"CVE-2026-87575","ts":1789365236802,"field":"exploit_available","old":"false","new":"true"},{"seq":188512,"id":"CVE-2026-87575","ts":1789365236802,"field":"cvss","old":null,"new":"5.4"},{"seq":188511,"id":"CVE-2026-87575","ts":1789365236802,"field":"severity","old":"none","new":"medium"},{"seq":187300,"id":"CVE-2026-87575","ts":1789363480173,"field":"exploit_available","old":"true","new":"false"},{"seq":187299,"id":"CVE-2026-87575","ts":1789363480173,"field":"cvss","old":"5.4","new":null},{"seq":187298,"id":"CVE-2026-87575","ts":1789363480173,"field":"severity","old":"medium","new":"none"},{"seq":186086,"id":"CVE-2026-87575","ts":1789361235459,"field":"exploit_available","old":"false","new":"true"},{"seq":186085,"id":"CVE-2026-87575","ts":1789361235459,"field":"cvss","old":null,"new":"5.4"},{"seq":186084,"id":"CVE-2026-87575","ts":1789361235459,"field":"severity","old":"none","new":"medium"},{"seq":184873,"id":"CVE-2026-87575","ts":1789358377201,"field":"exploit_available","old":"true","new":"false"},{"seq":184872,"id":"CVE-2026-87575","ts":1789358377201,"field":"cvss","old":"5.4","new":null},{"seq":184871,"id":"CVE-2026-87575","ts":1789358377201,"field":"severity","old":"medium","new":"none"},{"seq":183122,"id":"CVE-2026-87575","ts":1789354323312,"field":"exploit_available","old":"false","new":"true"},{"seq":183121,"id":"CVE-2026-87575","ts":1789354323312,"field":"cvss","old":null,"new":"5.4"}]}