{"id":"CVE-2026-87652","title":"Incorrect authorization in PushAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page","summary":"Incorrect authorization in PushAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)","severity":"low","cvss":3.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","cwe":["CWE-863"],"vendor":"google","product":"chrome","affected":["chrome < 153.0.8010.36"],"patched":["chrome 153.0.8010.36"],"published":"2026-09-09","updated":"2026-09-09","sourceUpdated":"2026-09-09T19:11:58.503","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87652","references":[{"url":"https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html","label":"chrome-cve-admin@google.com"},{"url":"https://issues.chromium.org/issues/499425100","label":"chrome-cve-admin@google.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-87652.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-87652"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-87652"}],"tags":["nvd","cve.org","csaf","vex","red-hat","score-dispute"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-09T17:09:44.638487Z"},"epss":0.00218,"epssPercentile":0.12483,"scores":{"nvd":3.1,"vendor":5.4,"adp":3.1},"ingestedAt":"2026-09-09T01:17:17.510Z","slug":"CVE-2026-87652","body":"## Overview\n\nIncorrect authorization in PushAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)\n\n## Affected\n\n- `chrome < 153.0.8010.36`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `chrome 153.0.8010.36`\n\n## Vendor advisories\n\n- **Red Hat VEX** · updated 2026-09-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-87652.json)","depth":"sunlit","depthScore":17,"depthScoreParts":{"impact":17.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":202615,"id":"CVE-2026-87652","ts":1789400086246,"field":"cvss","old":null,"new":"3.1"},{"seq":202614,"id":"CVE-2026-87652","ts":1789400086246,"field":"severity","old":"none","new":"low"},{"seq":201342,"id":"CVE-2026-87652","ts":1789397620796,"field":"cvss","old":"3.1","new":null},{"seq":201341,"id":"CVE-2026-87652","ts":1789397620796,"field":"severity","old":"low","new":"none"},{"seq":200035,"id":"CVE-2026-87652","ts":1789395578730,"field":"cvss","old":null,"new":"3.1"},{"seq":200034,"id":"CVE-2026-87652","ts":1789395578730,"field":"severity","old":"none","new":"low"},{"seq":199272,"id":"CVE-2026-87652","ts":1789392260851,"field":"cvss","old":"3.1","new":null},{"seq":199271,"id":"CVE-2026-87652","ts":1789392260851,"field":"severity","old":"low","new":"none"},{"seq":197605,"id":"CVE-2026-87652","ts":1789384297341,"field":"cvss","old":null,"new":"3.1"},{"seq":197604,"id":"CVE-2026-87652","ts":1789384297341,"field":"severity","old":"none","new":"low"},{"seq":196879,"id":"CVE-2026-87652","ts":1789383783666,"field":"cvss","old":"3.1","new":null},{"seq":196878,"id":"CVE-2026-87652","ts":1789383783666,"field":"severity","old":"low","new":"none"},{"seq":195783,"id":"CVE-2026-87652","ts":1789380578744,"field":"cvss","old":null,"new":"3.1"},{"seq":195782,"id":"CVE-2026-87652","ts":1789380578744,"field":"severity","old":"none","new":"low"},{"seq":194734,"id":"CVE-2026-87652","ts":1789378789999,"field":"cvss","old":"3.1","new":null},{"seq":194733,"id":"CVE-2026-87652","ts":1789378789999,"field":"severity","old":"low","new":"none"},{"seq":193521,"id":"CVE-2026-87652","ts":1789376521677,"field":"cvss","old":null,"new":"3.1"},{"seq":193520,"id":"CVE-2026-87652","ts":1789376521677,"field":"severity","old":"none","new":"low"},{"seq":192308,"id":"CVE-2026-87652","ts":1789373639811,"field":"cvss","old":"3.1","new":null},{"seq":192307,"id":"CVE-2026-87652","ts":1789373639811,"field":"severity","old":"low","new":"none"},{"seq":191093,"id":"CVE-2026-87652","ts":1789369489243,"field":"cvss","old":null,"new":"3.1"},{"seq":191092,"id":"CVE-2026-87652","ts":1789369489243,"field":"severity","old":"none","new":"low"},{"seq":189880,"id":"CVE-2026-87652","ts":1789368461376,"field":"cvss","old":"3.1","new":null},{"seq":189879,"id":"CVE-2026-87652","ts":1789368461376,"field":"severity","old":"low","new":"none"},{"seq":188663,"id":"CVE-2026-87652","ts":1789365237327,"field":"cvss","old":null,"new":"3.1"},{"seq":188662,"id":"CVE-2026-87652","ts":1789365237327,"field":"severity","old":"none","new":"low"},{"seq":187450,"id":"CVE-2026-87652","ts":1789363480719,"field":"cvss","old":"3.1","new":null},{"seq":187449,"id":"CVE-2026-87652","ts":1789363480719,"field":"severity","old":"low","new":"none"},{"seq":186236,"id":"CVE-2026-87652","ts":1789361236006,"field":"cvss","old":null,"new":"3.1"},{"seq":186235,"id":"CVE-2026-87652","ts":1789361236006,"field":"severity","old":"none","new":"low"},{"seq":185023,"id":"CVE-2026-87652","ts":1789358385469,"field":"cvss","old":"3.1","new":null},{"seq":185022,"id":"CVE-2026-87652","ts":1789358385469,"field":"severity","old":"low","new":"none"},{"seq":183272,"id":"CVE-2026-87652","ts":1789354323926,"field":"cvss","old":null,"new":"3.1"},{"seq":183271,"id":"CVE-2026-87652","ts":1789354323926,"field":"severity","old":"none","new":"low"},{"seq":182065,"id":"CVE-2026-87652","ts":1789353335703,"field":"cvss","old":"3.1","new":null},{"seq":182064,"id":"CVE-2026-87652","ts":1789353335703,"field":"severity","old":"low","new":"none"},{"seq":180858,"id":"CVE-2026-87652","ts":1789350291327,"field":"cvss","old":null,"new":"3.1"},{"seq":180857,"id":"CVE-2026-87652","ts":1789350291327,"field":"severity","old":"none","new":"low"},{"seq":179651,"id":"CVE-2026-87652","ts":1789348309031,"field":"cvss","old":"3.1","new":null},{"seq":179650,"id":"CVE-2026-87652","ts":1789348309031,"field":"severity","old":"low","new":"none"},{"seq":178444,"id":"CVE-2026-87652","ts":1789346378332,"field":"cvss","old":null,"new":"3.1"},{"seq":178443,"id":"CVE-2026-87652","ts":1789346378332,"field":"severity","old":"none","new":"low"},{"seq":177237,"id":"CVE-2026-87652","ts":1789343188992,"field":"cvss","old":"3.1","new":null},{"seq":177236,"id":"CVE-2026-87652","ts":1789343188992,"field":"severity","old":"low","new":"none"},{"seq":175354,"id":"CVE-2026-87652","ts":1789334885061,"field":"cvss","old":null,"new":"3.1"},{"seq":175353,"id":"CVE-2026-87652","ts":1789334885061,"field":"severity","old":"none","new":"low"},{"seq":174149,"id":"CVE-2026-87652","ts":1789333704116,"field":"cvss","old":"3.1","new":null},{"seq":174148,"id":"CVE-2026-87652","ts":1789333704116,"field":"severity","old":"low","new":"none"},{"seq":172963,"id":"CVE-2026-87652","ts":1789331097333,"field":"cvss","old":null,"new":"3.1"},{"seq":172962,"id":"CVE-2026-87652","ts":1789331097333,"field":"severity","old":"none","new":"low"}]}