CVE-2026-87450 is a high severity (CVSS) incorrect authorization flaw in the Permissions component of Google Chrome before 153.0.8010.36. A remote attacker leveraging social engineering could obtain sensitive information through a crafted Chrome extension. Google rated it Medium and fixed it in Chrome 153.
What's affected
Affected: Google Chrome before 153.0.8010.36. Fixed in the Chrome 153 stable release, which Google announced on 8 September 2026: 153.0.8010.36 for Linux and 153.0.8010.36 or .37 for Windows and Mac, rolling out over days and weeks. The component is Permissions.
Severity differs between sources. Google's Chromium security severity for this bug is Medium. The record's CVSS 3.1 score is 7.5 (High), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. These measure different things: the Chromium rating reflects how Google judges the bug inside its security model, including mitigations such as sandboxing, while the CVSS score is a generic base metric. Plan your patch timing against both.
The Chrome 153 release notes list 230 security fixes in total. They also say Google is aware of an exploit in the wild for a different CVE in the same release, CVE-2026-87491. The release notes do not say this CVE is exploited, and the record does not list it in CISA KEV.
How to check if you're exposed
Open chrome://version in the browser, or choose Help, then About Google Chrome. The version should be 153.0.8010.36 or later. Opening the About page also triggers an update check.
For a managed fleet, use your endpoint management or browser management console to report the installed Chrome version for every device, and look for devices below 153.0.8010.36. Pay attention to machines that rarely restart the browser, because Chrome applies an update only after a relaunch.
Other Chromium based browsers, such as Edge or Brave, ship their own versions and updates. Check each vendor's advisory for when they picked up the Chrome 153 fixes, as they do not all update on the same day. Electron applications bundle their own Chromium, so check them separately.
What to do now
- Update Chrome to 153.0.8010.36 or later and relaunch the browser.
- For managed fleets, confirm update policies are not holding Chrome back, and check the version report for stragglers.
- Check other Chromium based browsers and Electron applications you ship or run for their own fixed versions.
- Review the extensions installed on managed browsers and remove ones you do not need.
- Keep browser auto-update on as a standing control. Safeguard offers a free in-browser dependency scan at gold.safeguard.sh/scan that lists the package versions a project pulls in, which is a quick way to see whether an affected release is in your tree. Reachability analysis can then help you judge whether the vulnerable code path is actually used.
Why it matters
The weakness is incorrect authorization (CWE-863): a check exists but reaches the wrong decision. For a permissions component, that means an extension may be granted, or may use, access that the user or the policy did not allow.
The record says social engineering is part of the attack, so a user has to be persuaded to take an action, most likely installing or enabling an extension. That is a common route, so awareness training and extension allow lists help as much as the patch does.
Information disclosure is the impact. The record does not say which data. Treat any browser permission flaw as relevant to saved sessions and page content, and review which extensions on managed browsers hold broad permissions.
Quick check
What does the attacker need to do?
Per the record, persuade a user, and use a crafted extension. Updates remove the flaw. Policies reduce the chance of installing the extension.
Is any data type named?
The record says sensitive information without naming a type.
Sources
- Chrome Releases: Stable Channel Update for Desktop, 8 September 2026
- Chromium issue 517432155 (cited by the record; sign-in page when fetched)
- Safeguard Gold entry for CVE-2026-87450
Last reviewed: 18 October 2026.
