{"id":"CVE-2026-87595","title":"Server-side request forgery in Mobile in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page","summary":"Server-side request forgery in Mobile in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-918"],"vendor":"google","product":"chrome","affected":["chrome < 153.0.8010.36"],"patched":["chrome 153.0.8010.36"],"published":"2026-09-09","updated":"2026-09-14","sourceUpdated":"2026-09-14T21:43:53.327","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87595","references":[{"url":"https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html","label":"chrome-cve-admin@google.com"},{"url":"https://issues.chromium.org/issues/513726466","label":"chrome-cve-admin@google.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-87595.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-87595"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-87595"}],"tags":["nvd","cve.org","csaf","vex","red-hat","score-dispute"],"epss":0.00312,"epssPercentile":0.24331,"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-09-14T12:38:26.665903Z"},"scores":{"nvd":9.8,"vendor":4.3,"adp":9.8},"ingestedAt":"2026-09-09T01:17:17.506Z","slug":"CVE-2026-87595","body":"## Overview\n\nServer-side request forgery in Mobile in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)\n\n## Affected\n\n- `chrome < 153.0.8010.36`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `chrome 153.0.8010.36`\n\n## Vendor advisories\n\n- **Red Hat VEX** · updated 2026-09-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-87595.json)","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":202501,"id":"CVE-2026-87595","ts":1789400085684,"field":"cvss","old":null,"new":"9.8"},{"seq":202500,"id":"CVE-2026-87595","ts":1789400085684,"field":"severity","old":"none","new":"critical"},{"seq":201228,"id":"CVE-2026-87595","ts":1789397620382,"field":"cvss","old":"9.8","new":null},{"seq":201227,"id":"CVE-2026-87595","ts":1789397620382,"field":"severity","old":"critical","new":"none"},{"seq":200077,"id":"CVE-2026-87595","ts":1789395624102,"field":"cvss","old":"4.3","new":"9.8"},{"seq":200076,"id":"CVE-2026-87595","ts":1789395624102,"field":"severity","old":"medium","new":"critical"},{"seq":199921,"id":"CVE-2026-87595","ts":1789395578326,"field":"cvss","old":null,"new":"4.3"},{"seq":199920,"id":"CVE-2026-87595","ts":1789395578326,"field":"severity","old":"none","new":"medium"},{"seq":199162,"id":"CVE-2026-87595","ts":1789392260444,"field":"cvss","old":"4.3","new":null},{"seq":199161,"id":"CVE-2026-87595","ts":1789392260444,"field":"severity","old":"medium","new":"none"},{"seq":197495,"id":"CVE-2026-87595","ts":1789384296970,"field":"cvss","old":null,"new":"4.3"},{"seq":197494,"id":"CVE-2026-87595","ts":1789384296970,"field":"severity","old":"none","new":"medium"},{"seq":196769,"id":"CVE-2026-87595","ts":1789383775584,"field":"cvss","old":"4.3","new":null},{"seq":196768,"id":"CVE-2026-87595","ts":1789383775584,"field":"severity","old":"medium","new":"none"},{"seq":195673,"id":"CVE-2026-87595","ts":1789380578355,"field":"cvss","old":null,"new":"4.3"},{"seq":195672,"id":"CVE-2026-87595","ts":1789380578355,"field":"severity","old":"none","new":"medium"},{"seq":194624,"id":"CVE-2026-87595","ts":1789378789592,"field":"cvss","old":"4.3","new":null},{"seq":194623,"id":"CVE-2026-87595","ts":1789378789592,"field":"severity","old":"medium","new":"none"},{"seq":193411,"id":"CVE-2026-87595","ts":1789376521028,"field":"cvss","old":null,"new":"4.3"},{"seq":193410,"id":"CVE-2026-87595","ts":1789376521028,"field":"severity","old":"none","new":"medium"},{"seq":192198,"id":"CVE-2026-87595","ts":1789373639403,"field":"cvss","old":"4.3","new":null},{"seq":192197,"id":"CVE-2026-87595","ts":1789373639403,"field":"severity","old":"medium","new":"none"},{"seq":190983,"id":"CVE-2026-87595","ts":1789369488007,"field":"cvss","old":null,"new":"4.3"},{"seq":190982,"id":"CVE-2026-87595","ts":1789369488007,"field":"severity","old":"none","new":"medium"},{"seq":189770,"id":"CVE-2026-87595","ts":1789368460974,"field":"cvss","old":"4.3","new":null},{"seq":189769,"id":"CVE-2026-87595","ts":1789368460974,"field":"severity","old":"medium","new":"none"},{"seq":188553,"id":"CVE-2026-87595","ts":1789365236935,"field":"cvss","old":null,"new":"4.3"},{"seq":188552,"id":"CVE-2026-87595","ts":1789365236935,"field":"severity","old":"none","new":"medium"},{"seq":187340,"id":"CVE-2026-87595","ts":1789363480310,"field":"cvss","old":"4.3","new":null},{"seq":187339,"id":"CVE-2026-87595","ts":1789363480310,"field":"severity","old":"medium","new":"none"},{"seq":186126,"id":"CVE-2026-87595","ts":1789361235607,"field":"cvss","old":null,"new":"4.3"},{"seq":186125,"id":"CVE-2026-87595","ts":1789361235607,"field":"severity","old":"none","new":"medium"},{"seq":184913,"id":"CVE-2026-87595","ts":1789358377713,"field":"cvss","old":"4.3","new":null},{"seq":184912,"id":"CVE-2026-87595","ts":1789358377713,"field":"severity","old":"medium","new":"none"},{"seq":183162,"id":"CVE-2026-87595","ts":1789354323468,"field":"cvss","old":null,"new":"4.3"},{"seq":183161,"id":"CVE-2026-87595","ts":1789354323468,"field":"severity","old":"none","new":"medium"},{"seq":181955,"id":"CVE-2026-87595","ts":1789353335288,"field":"cvss","old":"4.3","new":null},{"seq":181954,"id":"CVE-2026-87595","ts":1789353335288,"field":"severity","old":"medium","new":"none"},{"seq":180748,"id":"CVE-2026-87595","ts":1789350290933,"field":"cvss","old":null,"new":"4.3"},{"seq":180747,"id":"CVE-2026-87595","ts":1789350290933,"field":"severity","old":"none","new":"medium"},{"seq":179541,"id":"CVE-2026-87595","ts":1789348308613,"field":"cvss","old":"4.3","new":null},{"seq":179540,"id":"CVE-2026-87595","ts":1789348308613,"field":"severity","old":"medium","new":"none"},{"seq":178334,"id":"CVE-2026-87595","ts":1789346377936,"field":"cvss","old":null,"new":"4.3"},{"seq":178333,"id":"CVE-2026-87595","ts":1789346377936,"field":"severity","old":"none","new":"medium"},{"seq":177127,"id":"CVE-2026-87595","ts":1789343188573,"field":"cvss","old":"4.3","new":null},{"seq":177126,"id":"CVE-2026-87595","ts":1789343188573,"field":"severity","old":"medium","new":"none"},{"seq":175244,"id":"CVE-2026-87595","ts":1789334884608,"field":"cvss","old":null,"new":"4.3"},{"seq":175243,"id":"CVE-2026-87595","ts":1789334884608,"field":"severity","old":"none","new":"medium"},{"seq":174039,"id":"CVE-2026-87595","ts":1789333703708,"field":"cvss","old":"4.3","new":null},{"seq":174038,"id":"CVE-2026-87595","ts":1789333703708,"field":"severity","old":"medium","new":"none"}]}