{"id":"CVE-2026-87544","title":"Incorrect authorization in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page","summary":"Incorrect authorization in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Low)","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-863"],"vendor":"google","product":"chrome","affected":["chrome < 153.0.8010.36"],"patched":["chrome 153.0.8010.36"],"published":"2026-09-09","updated":"2026-09-18","sourceUpdated":"2026-09-18T14:19:01.717","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87544","references":[{"url":"https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html","label":"chrome-cve-admin@google.com"},{"url":"https://issues.chromium.org/issues/542355360","label":"chrome-cve-admin@google.com"}],"tags":["nvd","cve.org"],"epss":0.00204,"epssPercentile":0.10723,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-09-18T13:15:42.686429Z"},"scores":{"nvd":9.8,"adp":8.8},"ingestedAt":"2026-09-09T01:17:17.505Z","slug":"CVE-2026-87544","body":"## Overview\n\nIncorrect authorization in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Low)\n\n## Affected\n\n- `chrome < 153.0.8010.36`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `chrome 153.0.8010.36`","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":202398,"id":"CVE-2026-87544","ts":1789400071145,"field":"cvss","old":null,"new":"9.8"},{"seq":202397,"id":"CVE-2026-87544","ts":1789400071145,"field":"severity","old":"none","new":"critical"},{"seq":201125,"id":"CVE-2026-87544","ts":1789397619997,"field":"cvss","old":"9.8","new":null},{"seq":201124,"id":"CVE-2026-87544","ts":1789397619997,"field":"severity","old":"critical","new":"none"},{"seq":199818,"id":"CVE-2026-87544","ts":1789395577970,"field":"cvss","old":null,"new":"9.8"},{"seq":199817,"id":"CVE-2026-87544","ts":1789395577970,"field":"severity","old":"none","new":"critical"},{"seq":199059,"id":"CVE-2026-87544","ts":1789392260097,"field":"cvss","old":"9.8","new":null},{"seq":199058,"id":"CVE-2026-87544","ts":1789392260097,"field":"severity","old":"critical","new":"none"},{"seq":197392,"id":"CVE-2026-87544","ts":1789384296631,"field":"cvss","old":null,"new":"9.8"},{"seq":197391,"id":"CVE-2026-87544","ts":1789384296631,"field":"severity","old":"none","new":"critical"},{"seq":196666,"id":"CVE-2026-87544","ts":1789383768907,"field":"cvss","old":"9.8","new":null},{"seq":196665,"id":"CVE-2026-87544","ts":1789383768907,"field":"severity","old":"critical","new":"none"},{"seq":195570,"id":"CVE-2026-87544","ts":1789380578012,"field":"cvss","old":null,"new":"9.8"},{"seq":195569,"id":"CVE-2026-87544","ts":1789380578012,"field":"severity","old":"none","new":"critical"},{"seq":194521,"id":"CVE-2026-87544","ts":1789378789241,"field":"cvss","old":"9.8","new":null},{"seq":194520,"id":"CVE-2026-87544","ts":1789378789241,"field":"severity","old":"critical","new":"none"},{"seq":193308,"id":"CVE-2026-87544","ts":1789376520654,"field":"cvss","old":null,"new":"9.8"},{"seq":193307,"id":"CVE-2026-87544","ts":1789376520654,"field":"severity","old":"none","new":"critical"},{"seq":192095,"id":"CVE-2026-87544","ts":1789373639017,"field":"cvss","old":"9.8","new":null},{"seq":192094,"id":"CVE-2026-87544","ts":1789373639017,"field":"severity","old":"critical","new":"none"},{"seq":190880,"id":"CVE-2026-87544","ts":1789369487551,"field":"cvss","old":null,"new":"9.8"},{"seq":190879,"id":"CVE-2026-87544","ts":1789369487551,"field":"severity","old":"none","new":"critical"},{"seq":189667,"id":"CVE-2026-87544","ts":1789368460620,"field":"cvss","old":"9.8","new":null},{"seq":189666,"id":"CVE-2026-87544","ts":1789368460620,"field":"severity","old":"critical","new":"none"},{"seq":188450,"id":"CVE-2026-87544","ts":1789365236578,"field":"cvss","old":null,"new":"9.8"},{"seq":188449,"id":"CVE-2026-87544","ts":1789365236578,"field":"severity","old":"none","new":"critical"},{"seq":187237,"id":"CVE-2026-87544","ts":1789363479958,"field":"cvss","old":"9.8","new":null},{"seq":187236,"id":"CVE-2026-87544","ts":1789363479958,"field":"severity","old":"critical","new":"none"},{"seq":186023,"id":"CVE-2026-87544","ts":1789361235218,"field":"cvss","old":null,"new":"9.8"},{"seq":186022,"id":"CVE-2026-87544","ts":1789361235218,"field":"severity","old":"none","new":"critical"},{"seq":184810,"id":"CVE-2026-87544","ts":1789358376958,"field":"cvss","old":"9.8","new":null},{"seq":184809,"id":"CVE-2026-87544","ts":1789358376958,"field":"severity","old":"critical","new":"none"},{"seq":183059,"id":"CVE-2026-87544","ts":1789354323068,"field":"cvss","old":null,"new":"9.8"},{"seq":183058,"id":"CVE-2026-87544","ts":1789354323068,"field":"severity","old":"none","new":"critical"},{"seq":181852,"id":"CVE-2026-87544","ts":1789353334938,"field":"cvss","old":"9.8","new":null},{"seq":181851,"id":"CVE-2026-87544","ts":1789353334938,"field":"severity","old":"critical","new":"none"},{"seq":180645,"id":"CVE-2026-87544","ts":1789350290565,"field":"cvss","old":null,"new":"9.8"},{"seq":180644,"id":"CVE-2026-87544","ts":1789350290565,"field":"severity","old":"none","new":"critical"},{"seq":179438,"id":"CVE-2026-87544","ts":1789348308228,"field":"cvss","old":"9.8","new":null},{"seq":179437,"id":"CVE-2026-87544","ts":1789348308228,"field":"severity","old":"critical","new":"none"},{"seq":178231,"id":"CVE-2026-87544","ts":1789346377584,"field":"cvss","old":null,"new":"9.8"},{"seq":178230,"id":"CVE-2026-87544","ts":1789346377584,"field":"severity","old":"none","new":"critical"},{"seq":177024,"id":"CVE-2026-87544","ts":1789343188175,"field":"cvss","old":"9.8","new":null},{"seq":177023,"id":"CVE-2026-87544","ts":1789343188175,"field":"severity","old":"critical","new":"none"},{"seq":175141,"id":"CVE-2026-87544","ts":1789334884218,"field":"cvss","old":null,"new":"9.8"},{"seq":175140,"id":"CVE-2026-87544","ts":1789334884218,"field":"severity","old":"none","new":"critical"},{"seq":173936,"id":"CVE-2026-87544","ts":1789333703355,"field":"cvss","old":"9.8","new":null},{"seq":173935,"id":"CVE-2026-87544","ts":1789333703355,"field":"severity","old":"critical","new":"none"},{"seq":172750,"id":"CVE-2026-87544","ts":1789331096591,"field":"cvss","old":null,"new":"9.8"},{"seq":172749,"id":"CVE-2026-87544","ts":1789331096591,"field":"severity","old":"none","new":"critical"}]}