{"id":"CVE-2026-87580","title":"Incorrect authorization in WebAppInstalls in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass site isolation via a crafted HTML page","summary":"Incorrect authorization in WebAppInstalls in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass site isolation via a crafted HTML page. (Chro…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","cwe":["CWE-863"],"vendor":"google","product":"chrome","affected":["chrome < 153.0.8010.36"],"patched":["chrome 153.0.8010.36"],"published":"2026-09-09","updated":"2026-09-11","sourceUpdated":"2026-09-11T14:39:26.440","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87580","references":[{"url":"https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html","label":"chrome-cve-admin@google.com"},{"url":"https://issues.chromium.org/issues/502986244","label":"chrome-cve-admin@google.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-87580.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-87580"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-87580"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-10T18:31:51.907039Z"},"epss":0.00213,"epssPercentile":0.11926,"scores":{"nvd":6.5,"vendor":5.4,"adp":6.5},"ingestedAt":"2026-09-09T01:17:17.510Z","slug":"CVE-2026-87580","body":"## Overview\n\nIncorrect authorization in WebAppInstalls in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)\n\n## Affected\n\n- `chrome < 153.0.8010.36`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `chrome 153.0.8010.36`\n\n## Vendor advisories\n\n- **Red Hat VEX** · updated 2026-09-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-87580.json)","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":202471,"id":"CVE-2026-87580","ts":1789400078009,"field":"cvss","old":null,"new":"6.5"},{"seq":202470,"id":"CVE-2026-87580","ts":1789400078009,"field":"severity","old":"none","new":"medium"},{"seq":201198,"id":"CVE-2026-87580","ts":1789397620272,"field":"cvss","old":"6.5","new":null},{"seq":201197,"id":"CVE-2026-87580","ts":1789397620272,"field":"severity","old":"medium","new":"none"},{"seq":199891,"id":"CVE-2026-87580","ts":1789395578224,"field":"cvss","old":null,"new":"6.5"},{"seq":199890,"id":"CVE-2026-87580","ts":1789395578224,"field":"severity","old":"none","new":"medium"},{"seq":199132,"id":"CVE-2026-87580","ts":1789392260336,"field":"cvss","old":"6.5","new":null},{"seq":199131,"id":"CVE-2026-87580","ts":1789392260336,"field":"severity","old":"medium","new":"none"},{"seq":197465,"id":"CVE-2026-87580","ts":1789384296876,"field":"cvss","old":null,"new":"6.5"},{"seq":197464,"id":"CVE-2026-87580","ts":1789384296876,"field":"severity","old":"none","new":"medium"},{"seq":196739,"id":"CVE-2026-87580","ts":1789383773625,"field":"cvss","old":"6.5","new":null},{"seq":196738,"id":"CVE-2026-87580","ts":1789383773625,"field":"severity","old":"medium","new":"none"},{"seq":195643,"id":"CVE-2026-87580","ts":1789380578255,"field":"cvss","old":null,"new":"6.5"},{"seq":195642,"id":"CVE-2026-87580","ts":1789380578255,"field":"severity","old":"none","new":"medium"},{"seq":194594,"id":"CVE-2026-87580","ts":1789378789491,"field":"cvss","old":"6.5","new":null},{"seq":194593,"id":"CVE-2026-87580","ts":1789378789491,"field":"severity","old":"medium","new":"none"},{"seq":193381,"id":"CVE-2026-87580","ts":1789376520911,"field":"cvss","old":null,"new":"6.5"},{"seq":193380,"id":"CVE-2026-87580","ts":1789376520911,"field":"severity","old":"none","new":"medium"},{"seq":192168,"id":"CVE-2026-87580","ts":1789373639299,"field":"cvss","old":"6.5","new":null},{"seq":192167,"id":"CVE-2026-87580","ts":1789373639299,"field":"severity","old":"medium","new":"none"},{"seq":190953,"id":"CVE-2026-87580","ts":1789369487889,"field":"cvss","old":null,"new":"6.5"},{"seq":190952,"id":"CVE-2026-87580","ts":1789369487889,"field":"severity","old":"none","new":"medium"},{"seq":189740,"id":"CVE-2026-87580","ts":1789368460872,"field":"cvss","old":"6.5","new":null},{"seq":189739,"id":"CVE-2026-87580","ts":1789368460872,"field":"severity","old":"medium","new":"none"},{"seq":188523,"id":"CVE-2026-87580","ts":1789365236836,"field":"cvss","old":null,"new":"6.5"},{"seq":188522,"id":"CVE-2026-87580","ts":1789365236836,"field":"severity","old":"none","new":"medium"},{"seq":187310,"id":"CVE-2026-87580","ts":1789363480206,"field":"cvss","old":"6.5","new":null},{"seq":187309,"id":"CVE-2026-87580","ts":1789363480206,"field":"severity","old":"medium","new":"none"},{"seq":186096,"id":"CVE-2026-87580","ts":1789361235498,"field":"cvss","old":null,"new":"6.5"},{"seq":186095,"id":"CVE-2026-87580","ts":1789361235498,"field":"severity","old":"none","new":"medium"},{"seq":184883,"id":"CVE-2026-87580","ts":1789358377239,"field":"cvss","old":"6.5","new":null},{"seq":184882,"id":"CVE-2026-87580","ts":1789358377239,"field":"severity","old":"medium","new":"none"},{"seq":183132,"id":"CVE-2026-87580","ts":1789354323351,"field":"cvss","old":null,"new":"6.5"},{"seq":183131,"id":"CVE-2026-87580","ts":1789354323351,"field":"severity","old":"none","new":"medium"},{"seq":181925,"id":"CVE-2026-87580","ts":1789353335186,"field":"cvss","old":"6.5","new":null},{"seq":181924,"id":"CVE-2026-87580","ts":1789353335186,"field":"severity","old":"medium","new":"none"},{"seq":180718,"id":"CVE-2026-87580","ts":1789350290832,"field":"cvss","old":null,"new":"6.5"},{"seq":180717,"id":"CVE-2026-87580","ts":1789350290832,"field":"severity","old":"none","new":"medium"},{"seq":179511,"id":"CVE-2026-87580","ts":1789348308500,"field":"cvss","old":"6.5","new":null},{"seq":179510,"id":"CVE-2026-87580","ts":1789348308500,"field":"severity","old":"medium","new":"none"},{"seq":178304,"id":"CVE-2026-87580","ts":1789346377829,"field":"cvss","old":null,"new":"6.5"},{"seq":178303,"id":"CVE-2026-87580","ts":1789346377829,"field":"severity","old":"none","new":"medium"},{"seq":177097,"id":"CVE-2026-87580","ts":1789343188448,"field":"cvss","old":"6.5","new":null},{"seq":177096,"id":"CVE-2026-87580","ts":1789343188448,"field":"severity","old":"medium","new":"none"},{"seq":175214,"id":"CVE-2026-87580","ts":1789334884493,"field":"cvss","old":null,"new":"6.5"},{"seq":175213,"id":"CVE-2026-87580","ts":1789334884493,"field":"severity","old":"none","new":"medium"},{"seq":174009,"id":"CVE-2026-87580","ts":1789333703605,"field":"cvss","old":"6.5","new":null},{"seq":174008,"id":"CVE-2026-87580","ts":1789333703605,"field":"severity","old":"medium","new":"none"},{"seq":172823,"id":"CVE-2026-87580","ts":1789331096836,"field":"cvss","old":null,"new":"6.5"},{"seq":172822,"id":"CVE-2026-87580","ts":1789331096836,"field":"severity","old":"none","new":"medium"}]}