CVE-2026-87433 is a high severity (CVSS) race condition in the FileAPI component of Google Chrome before 153.0.8010.36. A remote attacker who has already compromised the renderer process could bypass site isolation using a crafted HTML page. Google rated it Medium and fixed it in Chrome 153.
What's affected
Affected: Google Chrome before 153.0.8010.36. Fixed in the Chrome 153 stable release, which Google announced on 8 September 2026: 153.0.8010.36 for Linux and 153.0.8010.36 or .37 for Windows and Mac, rolling out over days and weeks. The component is FileAPI.
Severity differs between sources. Google's Chromium security severity for this bug is Medium. The record's CVSS 3.1 score is 8.8 (High), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. These measure different things: the Chromium rating reflects how Google judges the bug inside its security model, including mitigations such as sandboxing, while the CVSS score is a generic base metric. Plan your patch timing against both.
The Chrome 153 release notes list 230 security fixes in total. They also say Google is aware of an exploit in the wild for a different CVE in the same release, CVE-2026-87491. The release notes do not say this CVE is exploited, and the record does not list it in CISA KEV.
How to check if you're exposed
Open chrome://version in the browser, or choose Help, then About Google Chrome. The version should be 153.0.8010.36 or later. Opening the About page also triggers an update check.
For a managed fleet, use your endpoint management or browser management console to report the installed Chrome version for every device, and look for devices below 153.0.8010.36. Pay attention to machines that rarely restart the browser, because Chrome applies an update only after a relaunch.
Other Chromium based browsers, such as Edge or Brave, ship their own versions and updates. Check each vendor's advisory for when they picked up the Chrome 153 fixes, as they do not all update on the same day. Electron applications bundle their own Chromium, so check them separately.
What to do now
- Update Chrome to 153.0.8010.36 or later and relaunch the browser.
- For managed fleets, confirm update policies are not holding Chrome back, and check the version report for stragglers.
- Check other Chromium based browsers and Electron applications you ship or run for their own fixed versions.
- Review the extensions installed on managed browsers and remove ones you do not need.
- Keep browser auto-update on as a standing control. Safeguard offers a free in-browser dependency scan at gold.safeguard.sh/scan that lists the package versions a project pulls in, which is a quick way to see whether an affected release is in your tree. Reachability analysis can then help you judge whether the vulnerable code path is actually used.
Why it matters
The weakness is a race condition (CWE-367), a time of check to time of use flaw. Two operations that should happen in order can interleave, and a state that was valid when checked is not valid when used.
The precondition matters: the attacker must already have compromised the renderer process. That is a separate bug, usually a memory corruption flaw. Site isolation is the defence that keeps a compromised renderer for one site away from the data of another, so bypassing it turns a contained compromise into one that can reach other sites' data. This is why Google rates it Medium on its own, while a generic CVSS score reads higher.
Such bugs are links in a chain. They rarely matter alone and matter a lot when combined with a renderer exploit, and the Chrome 153 notes show an exploit exists in the wild for another CVE. Updating promptly is the rational response.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Can this be used on its own?
Per the record, the attacker must first compromise the renderer, so it is a second step in a chain.
What is site isolation?
A Chrome security feature that places pages from different sites in different processes so one compromised page cannot read another site's data.
Sources
- Chrome Releases: Stable Channel Update for Desktop, 8 September 2026
- Chromium issue 497574154 (cited by the record; sign-in page when fetched)
- Safeguard Gold entry for CVE-2026-87433
Last reviewed: 18 October 2026.
