{"id":"CVE-2026-87441","title":"Missing authorization in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension","summary":"Missing authorization in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","cwe":["CWE-862"],"vendor":"google","product":"chrome","affected":["chrome < 153.0.8010.36"],"patched":["chrome 153.0.8010.36"],"published":"2026-09-09","updated":"2026-09-10","sourceUpdated":"2026-09-10T19:19:46.600","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87441","references":[{"url":"https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html","label":"chrome-cve-admin@google.com"},{"url":"https://issues.chromium.org/issues/514556469","label":"chrome-cve-admin@google.com"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-10T14:52:46.577821Z"},"epss":0.00246,"epssPercentile":0.1415,"ingestedAt":"2026-09-09T01:17:17.508Z","slug":"CVE-2026-87441","body":"## Overview\n\nMissing authorization in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)\n\n## Affected\n\n- `chrome < 153.0.8010.36`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `chrome 153.0.8010.36`","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":202187,"id":"CVE-2026-87441","ts":1789400064982,"field":"cvss","old":null,"new":"6.5"},{"seq":202186,"id":"CVE-2026-87441","ts":1789400064982,"field":"severity","old":"none","new":"medium"},{"seq":200914,"id":"CVE-2026-87441","ts":1789397618501,"field":"cvss","old":"6.5","new":null},{"seq":200913,"id":"CVE-2026-87441","ts":1789397618501,"field":"severity","old":"medium","new":"none"},{"seq":199607,"id":"CVE-2026-87441","ts":1789395561469,"field":"cvss","old":null,"new":"6.5"},{"seq":199606,"id":"CVE-2026-87441","ts":1789395561469,"field":"severity","old":"none","new":"medium"},{"seq":198852,"id":"CVE-2026-87441","ts":1789392249852,"field":"cvss","old":"6.5","new":null},{"seq":198851,"id":"CVE-2026-87441","ts":1789392249852,"field":"severity","old":"medium","new":"none"},{"seq":197185,"id":"CVE-2026-87441","ts":1789384295969,"field":"cvss","old":null,"new":"6.5"},{"seq":197184,"id":"CVE-2026-87441","ts":1789384295969,"field":"severity","old":"none","new":"medium"},{"seq":196459,"id":"CVE-2026-87441","ts":1789383757819,"field":"cvss","old":"6.5","new":null},{"seq":196458,"id":"CVE-2026-87441","ts":1789383757819,"field":"severity","old":"medium","new":"none"},{"seq":195363,"id":"CVE-2026-87441","ts":1789380576777,"field":"cvss","old":null,"new":"6.5"},{"seq":195362,"id":"CVE-2026-87441","ts":1789380576777,"field":"severity","old":"none","new":"medium"},{"seq":194314,"id":"CVE-2026-87441","ts":1789378785146,"field":"cvss","old":"6.5","new":null},{"seq":194313,"id":"CVE-2026-87441","ts":1789378785146,"field":"severity","old":"medium","new":"none"},{"seq":193101,"id":"CVE-2026-87441","ts":1789376519892,"field":"cvss","old":null,"new":"6.5"},{"seq":193100,"id":"CVE-2026-87441","ts":1789376519892,"field":"severity","old":"none","new":"medium"},{"seq":191888,"id":"CVE-2026-87441","ts":1789373633391,"field":"cvss","old":"6.5","new":null},{"seq":191887,"id":"CVE-2026-87441","ts":1789373633391,"field":"severity","old":"medium","new":"none"},{"seq":190673,"id":"CVE-2026-87441","ts":1789369486434,"field":"cvss","old":null,"new":"6.5"},{"seq":190672,"id":"CVE-2026-87441","ts":1789369486434,"field":"severity","old":"none","new":"medium"},{"seq":189460,"id":"CVE-2026-87441","ts":1789368450965,"field":"cvss","old":"6.5","new":null},{"seq":189459,"id":"CVE-2026-87441","ts":1789368450965,"field":"severity","old":"medium","new":"none"},{"seq":188243,"id":"CVE-2026-87441","ts":1789365235871,"field":"cvss","old":null,"new":"6.5"},{"seq":188242,"id":"CVE-2026-87441","ts":1789365235871,"field":"severity","old":"none","new":"medium"},{"seq":187030,"id":"CVE-2026-87441","ts":1789363473201,"field":"cvss","old":"6.5","new":null},{"seq":187029,"id":"CVE-2026-87441","ts":1789363473201,"field":"severity","old":"medium","new":"none"},{"seq":185816,"id":"CVE-2026-87441","ts":1789361234503,"field":"cvss","old":null,"new":"6.5"},{"seq":185815,"id":"CVE-2026-87441","ts":1789361234503,"field":"severity","old":"none","new":"medium"},{"seq":184603,"id":"CVE-2026-87441","ts":1789358366482,"field":"cvss","old":"6.5","new":null},{"seq":184602,"id":"CVE-2026-87441","ts":1789358366482,"field":"severity","old":"medium","new":"none"},{"seq":182853,"id":"CVE-2026-87441","ts":1789354322245,"field":"cvss","old":null,"new":"6.5"},{"seq":182852,"id":"CVE-2026-87441","ts":1789354322245,"field":"severity","old":"none","new":"medium"},{"seq":181646,"id":"CVE-2026-87441","ts":1789353325477,"field":"cvss","old":"6.5","new":null},{"seq":181645,"id":"CVE-2026-87441","ts":1789353325477,"field":"severity","old":"medium","new":"none"},{"seq":180439,"id":"CVE-2026-87441","ts":1789350289830,"field":"cvss","old":null,"new":"6.5"},{"seq":180438,"id":"CVE-2026-87441","ts":1789350289830,"field":"severity","old":"none","new":"medium"},{"seq":179232,"id":"CVE-2026-87441","ts":1789348296845,"field":"cvss","old":"6.5","new":null},{"seq":179231,"id":"CVE-2026-87441","ts":1789348296845,"field":"severity","old":"medium","new":"none"},{"seq":178025,"id":"CVE-2026-87441","ts":1789346376883,"field":"cvss","old":null,"new":"6.5"},{"seq":178024,"id":"CVE-2026-87441","ts":1789346376883,"field":"severity","old":"none","new":"medium"},{"seq":176818,"id":"CVE-2026-87441","ts":1789343186555,"field":"cvss","old":"6.5","new":null},{"seq":176817,"id":"CVE-2026-87441","ts":1789343186555,"field":"severity","old":"medium","new":"none"},{"seq":174935,"id":"CVE-2026-87441","ts":1789334883402,"field":"cvss","old":null,"new":"6.5"},{"seq":174934,"id":"CVE-2026-87441","ts":1789334883402,"field":"severity","old":"none","new":"medium"},{"seq":173730,"id":"CVE-2026-87441","ts":1789333702617,"field":"cvss","old":"6.5","new":null},{"seq":173729,"id":"CVE-2026-87441","ts":1789333702617,"field":"severity","old":"medium","new":"none"},{"seq":172544,"id":"CVE-2026-87441","ts":1789331095858,"field":"cvss","old":null,"new":"6.5"},{"seq":172543,"id":"CVE-2026-87441","ts":1789331095858,"field":"severity","old":"none","new":"medium"}]}