CVE-2026-87544 is an incorrect authorization flaw in the Extensions component of Google Chrome. The record scores it 9.8, while Chromium rates it Low. A crafted HTML page could bypass restrictions and reach a privileged page. Chrome 153.0.8010.36 and later contain the fix, so update desktop browsers.
What's affected
The record lists Google Chrome before 153.0.8010.36. The Chrome Releases post for the 153 stable channel lists 153.0.8010.36 for Linux and 153.0.8010.36 or .37 for Windows and Mac, and says the build carries 230 security fixes.
As with the sibling Android issue in the same release, the record score is 9.8 and Chromium's own rating is Low. Use the fixed build as the target.
How to check if you're exposed
In Chrome, open chrome://version and read the first line. It must be 153.0.8010.36 or later. Chrome applies updates after a restart, so a browser that has been open for days may be behind even when the update is downloaded.
For fleets, use your endpoint management tool or the Chrome Browser Cloud Management console to list versions, and find machines that still run older builds. Remember Chromium based browsers such as Edge update on their own schedule, so check their release notes too.
What to do now
- Update Chrome to 153.0.8010.36 or later and relaunch it.
- Use your management tool to report versions and flag laggards.
- Check Chromium based browsers for their own fixed release.
- Review the extensions installed across the fleet and remove those that no one uses.
Why it matters
The weakness is CWE-863 (incorrect authorization). The extension system gives some pages special powers, and a check that decides which page gets them did not work correctly in one case. Chromium rated this Low, because the attacker needs a crafted page and the bug tracker details are held back until most users update.
The record does not mark this CVE as known exploited, and it is not in the CISA KEV list. For any browser flaw, speed of rollout matters more than the exact score.
Quick check
Do I need to restart Chrome?
Yes. The new version only runs after a relaunch.
If you want a quick look at your own dependencies, the free in-browser scan at gold.safeguard.sh/scan needs no repository access.
Sources
Fetched for this guide:
Last reviewed: 19 October 2026.
