{"id":"CVE-2026-87549","title":"Incomplete cleanup in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page","summary":"Incomplete cleanup in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","cwe":["CWE-459"],"vendor":"google","product":"chrome","affected":["chrome < 153.0.8010.36"],"patched":["chrome 153.0.8010.36"],"published":"2026-09-09","updated":"2026-09-10","sourceUpdated":"2026-09-10T16:18:05.727","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87549","references":[{"url":"https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html","label":"chrome-cve-admin@google.com"},{"url":"https://issues.chromium.org/issues/516534546","label":"chrome-cve-admin@google.com"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-10T15:03:35.802557Z"},"epss":0.00323,"epssPercentile":0.25602,"ingestedAt":"2026-09-09T01:17:17.508Z","slug":"CVE-2026-87549","body":"## Overview\n\nIncomplete cleanup in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)\n\n## Affected\n\n- `chrome < 153.0.8010.36`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `chrome 153.0.8010.36`","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":202408,"id":"CVE-2026-87549","ts":1789400072064,"field":"cvss","old":null,"new":"6.5"},{"seq":202407,"id":"CVE-2026-87549","ts":1789400072064,"field":"severity","old":"none","new":"medium"},{"seq":201135,"id":"CVE-2026-87549","ts":1789397620036,"field":"cvss","old":"6.5","new":null},{"seq":201134,"id":"CVE-2026-87549","ts":1789397620036,"field":"severity","old":"medium","new":"none"},{"seq":199828,"id":"CVE-2026-87549","ts":1789395578006,"field":"cvss","old":null,"new":"6.5"},{"seq":199827,"id":"CVE-2026-87549","ts":1789395578006,"field":"severity","old":"none","new":"medium"},{"seq":199069,"id":"CVE-2026-87549","ts":1789392260131,"field":"cvss","old":"6.5","new":null},{"seq":199068,"id":"CVE-2026-87549","ts":1789392260131,"field":"severity","old":"medium","new":"none"},{"seq":197402,"id":"CVE-2026-87549","ts":1789384296665,"field":"cvss","old":null,"new":"6.5"},{"seq":197401,"id":"CVE-2026-87549","ts":1789384296665,"field":"severity","old":"none","new":"medium"},{"seq":196676,"id":"CVE-2026-87549","ts":1789383769559,"field":"cvss","old":"6.5","new":null},{"seq":196675,"id":"CVE-2026-87549","ts":1789383769559,"field":"severity","old":"medium","new":"none"},{"seq":195580,"id":"CVE-2026-87549","ts":1789380578046,"field":"cvss","old":null,"new":"6.5"},{"seq":195579,"id":"CVE-2026-87549","ts":1789380578046,"field":"severity","old":"none","new":"medium"},{"seq":194531,"id":"CVE-2026-87549","ts":1789378789274,"field":"cvss","old":"6.5","new":null},{"seq":194530,"id":"CVE-2026-87549","ts":1789378789274,"field":"severity","old":"medium","new":"none"},{"seq":193318,"id":"CVE-2026-87549","ts":1789376520689,"field":"cvss","old":null,"new":"6.5"},{"seq":193317,"id":"CVE-2026-87549","ts":1789376520689,"field":"severity","old":"none","new":"medium"},{"seq":192105,"id":"CVE-2026-87549","ts":1789373639062,"field":"cvss","old":"6.5","new":null},{"seq":192104,"id":"CVE-2026-87549","ts":1789373639062,"field":"severity","old":"medium","new":"none"},{"seq":190890,"id":"CVE-2026-87549","ts":1789369487589,"field":"cvss","old":null,"new":"6.5"},{"seq":190889,"id":"CVE-2026-87549","ts":1789369487589,"field":"severity","old":"none","new":"medium"},{"seq":189677,"id":"CVE-2026-87549","ts":1789368460656,"field":"cvss","old":"6.5","new":null},{"seq":189676,"id":"CVE-2026-87549","ts":1789368460656,"field":"severity","old":"medium","new":"none"},{"seq":188460,"id":"CVE-2026-87549","ts":1789365236610,"field":"cvss","old":null,"new":"6.5"},{"seq":188459,"id":"CVE-2026-87549","ts":1789365236610,"field":"severity","old":"none","new":"medium"},{"seq":187247,"id":"CVE-2026-87549","ts":1789363479993,"field":"cvss","old":"6.5","new":null},{"seq":187246,"id":"CVE-2026-87549","ts":1789363479993,"field":"severity","old":"medium","new":"none"},{"seq":186033,"id":"CVE-2026-87549","ts":1789361235252,"field":"cvss","old":null,"new":"6.5"},{"seq":186032,"id":"CVE-2026-87549","ts":1789361235252,"field":"severity","old":"none","new":"medium"},{"seq":184820,"id":"CVE-2026-87549","ts":1789358376991,"field":"cvss","old":"6.5","new":null},{"seq":184819,"id":"CVE-2026-87549","ts":1789358376991,"field":"severity","old":"medium","new":"none"},{"seq":183069,"id":"CVE-2026-87549","ts":1789354323107,"field":"cvss","old":null,"new":"6.5"},{"seq":183068,"id":"CVE-2026-87549","ts":1789354323107,"field":"severity","old":"none","new":"medium"},{"seq":181862,"id":"CVE-2026-87549","ts":1789353334973,"field":"cvss","old":"6.5","new":null},{"seq":181861,"id":"CVE-2026-87549","ts":1789353334973,"field":"severity","old":"medium","new":"none"},{"seq":180655,"id":"CVE-2026-87549","ts":1789350290606,"field":"cvss","old":null,"new":"6.5"},{"seq":180654,"id":"CVE-2026-87549","ts":1789350290606,"field":"severity","old":"none","new":"medium"},{"seq":179448,"id":"CVE-2026-87549","ts":1789348308262,"field":"cvss","old":"6.5","new":null},{"seq":179447,"id":"CVE-2026-87549","ts":1789348308262,"field":"severity","old":"medium","new":"none"},{"seq":178241,"id":"CVE-2026-87549","ts":1789346377617,"field":"cvss","old":null,"new":"6.5"},{"seq":178240,"id":"CVE-2026-87549","ts":1789346377617,"field":"severity","old":"none","new":"medium"},{"seq":177034,"id":"CVE-2026-87549","ts":1789343188210,"field":"cvss","old":"6.5","new":null},{"seq":177033,"id":"CVE-2026-87549","ts":1789343188210,"field":"severity","old":"medium","new":"none"},{"seq":175151,"id":"CVE-2026-87549","ts":1789334884256,"field":"cvss","old":null,"new":"6.5"},{"seq":175150,"id":"CVE-2026-87549","ts":1789334884256,"field":"severity","old":"none","new":"medium"},{"seq":173946,"id":"CVE-2026-87549","ts":1789333703389,"field":"cvss","old":"6.5","new":null},{"seq":173945,"id":"CVE-2026-87549","ts":1789333703389,"field":"severity","old":"medium","new":"none"},{"seq":172760,"id":"CVE-2026-87549","ts":1789331096625,"field":"cvss","old":null,"new":"6.5"},{"seq":172759,"id":"CVE-2026-87549","ts":1789331096625,"field":"severity","old":"none","new":"medium"}]}