{"id":"CVE-2026-87433","title":"Race condition in FileAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page","summary":"Race condition in FileAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":["CWE-367"],"vendor":"google","product":"chrome","affected":["chrome < 153.0.8010.36"],"patched":["chrome 153.0.8010.36"],"published":"2026-09-09","updated":"2026-09-10","sourceUpdated":"2026-09-10T16:18:04.310","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87433","references":[{"url":"https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html","label":"chrome-cve-admin@google.com"},{"url":"https://issues.chromium.org/issues/497574154","label":"chrome-cve-admin@google.com"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-09-10T15:35:27.045988Z"},"epss":0.00297,"epssPercentile":0.2262,"ingestedAt":"2026-09-09T01:17:17.510Z","slug":"CVE-2026-87433","body":"## Overview\n\nRace condition in FileAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)\n\n## Affected\n\n- `chrome < 153.0.8010.36`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `chrome 153.0.8010.36`","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":202171,"id":"CVE-2026-87433","ts":1789400064921,"field":"cvss","old":null,"new":"8.8"},{"seq":202170,"id":"CVE-2026-87433","ts":1789400064921,"field":"severity","old":"none","new":"high"},{"seq":200898,"id":"CVE-2026-87433","ts":1789397618386,"field":"cvss","old":"8.8","new":null},{"seq":200897,"id":"CVE-2026-87433","ts":1789397618386,"field":"severity","old":"high","new":"none"},{"seq":199591,"id":"CVE-2026-87433","ts":1789395560216,"field":"cvss","old":null,"new":"8.8"},{"seq":199590,"id":"CVE-2026-87433","ts":1789395560216,"field":"severity","old":"none","new":"high"},{"seq":198836,"id":"CVE-2026-87433","ts":1789392248622,"field":"cvss","old":"8.8","new":null},{"seq":198835,"id":"CVE-2026-87433","ts":1789392248622,"field":"severity","old":"high","new":"none"},{"seq":197169,"id":"CVE-2026-87433","ts":1789384295920,"field":"cvss","old":null,"new":"8.8"},{"seq":197168,"id":"CVE-2026-87433","ts":1789384295920,"field":"severity","old":"none","new":"high"},{"seq":196443,"id":"CVE-2026-87433","ts":1789383757764,"field":"cvss","old":"8.8","new":null},{"seq":196442,"id":"CVE-2026-87433","ts":1789383757764,"field":"severity","old":"high","new":"none"},{"seq":195347,"id":"CVE-2026-87433","ts":1789380576722,"field":"cvss","old":null,"new":"8.8"},{"seq":195346,"id":"CVE-2026-87433","ts":1789380576722,"field":"severity","old":"none","new":"high"},{"seq":194298,"id":"CVE-2026-87433","ts":1789378785031,"field":"cvss","old":"8.8","new":null},{"seq":194297,"id":"CVE-2026-87433","ts":1789378785031,"field":"severity","old":"high","new":"none"},{"seq":193085,"id":"CVE-2026-87433","ts":1789376519836,"field":"cvss","old":null,"new":"8.8"},{"seq":193084,"id":"CVE-2026-87433","ts":1789376519836,"field":"severity","old":"none","new":"high"},{"seq":191872,"id":"CVE-2026-87433","ts":1789373633280,"field":"cvss","old":"8.8","new":null},{"seq":191871,"id":"CVE-2026-87433","ts":1789373633280,"field":"severity","old":"high","new":"none"},{"seq":190657,"id":"CVE-2026-87433","ts":1789369486366,"field":"cvss","old":null,"new":"8.8"},{"seq":190656,"id":"CVE-2026-87433","ts":1789369486366,"field":"severity","old":"none","new":"high"},{"seq":189444,"id":"CVE-2026-87433","ts":1789368449848,"field":"cvss","old":"8.8","new":null},{"seq":189443,"id":"CVE-2026-87433","ts":1789368449848,"field":"severity","old":"high","new":"none"},{"seq":188227,"id":"CVE-2026-87433","ts":1789365235814,"field":"cvss","old":null,"new":"8.8"},{"seq":188226,"id":"CVE-2026-87433","ts":1789365235814,"field":"severity","old":"none","new":"high"},{"seq":187014,"id":"CVE-2026-87433","ts":1789363473089,"field":"cvss","old":"8.8","new":null},{"seq":187013,"id":"CVE-2026-87433","ts":1789363473089,"field":"severity","old":"high","new":"none"},{"seq":185800,"id":"CVE-2026-87433","ts":1789361234448,"field":"cvss","old":null,"new":"8.8"},{"seq":185799,"id":"CVE-2026-87433","ts":1789361234448,"field":"severity","old":"none","new":"high"},{"seq":184587,"id":"CVE-2026-87433","ts":1789358366173,"field":"cvss","old":"8.8","new":null},{"seq":184586,"id":"CVE-2026-87433","ts":1789358366173,"field":"severity","old":"high","new":"none"},{"seq":182837,"id":"CVE-2026-87433","ts":1789354322182,"field":"cvss","old":null,"new":"8.8"},{"seq":182836,"id":"CVE-2026-87433","ts":1789354322182,"field":"severity","old":"none","new":"high"},{"seq":181630,"id":"CVE-2026-87433","ts":1789353324407,"field":"cvss","old":"8.8","new":null},{"seq":181629,"id":"CVE-2026-87433","ts":1789353324407,"field":"severity","old":"high","new":"none"},{"seq":180423,"id":"CVE-2026-87433","ts":1789350289777,"field":"cvss","old":null,"new":"8.8"},{"seq":180422,"id":"CVE-2026-87433","ts":1789350289777,"field":"severity","old":"none","new":"high"},{"seq":179216,"id":"CVE-2026-87433","ts":1789348295582,"field":"cvss","old":"8.8","new":null},{"seq":179215,"id":"CVE-2026-87433","ts":1789348295582,"field":"severity","old":"high","new":"none"},{"seq":178009,"id":"CVE-2026-87433","ts":1789346376830,"field":"cvss","old":null,"new":"8.8"},{"seq":178008,"id":"CVE-2026-87433","ts":1789346376830,"field":"severity","old":"none","new":"high"},{"seq":176802,"id":"CVE-2026-87433","ts":1789343186442,"field":"cvss","old":"8.8","new":null},{"seq":176801,"id":"CVE-2026-87433","ts":1789343186442,"field":"severity","old":"high","new":"none"},{"seq":174919,"id":"CVE-2026-87433","ts":1789334883340,"field":"cvss","old":null,"new":"8.8"},{"seq":174918,"id":"CVE-2026-87433","ts":1789334883340,"field":"severity","old":"none","new":"high"},{"seq":173714,"id":"CVE-2026-87433","ts":1789333702558,"field":"cvss","old":"8.8","new":null},{"seq":173713,"id":"CVE-2026-87433","ts":1789333702558,"field":"severity","old":"high","new":"none"},{"seq":172528,"id":"CVE-2026-87433","ts":1789331095804,"field":"cvss","old":null,"new":"8.8"},{"seq":172527,"id":"CVE-2026-87433","ts":1789331095804,"field":"severity","old":"none","new":"high"}]}