CVE-2026-87569 is a high severity missing authorization flaw in the Views component of Google Chrome before 153.0.8010.36. A remote attacker leveraging social engineering could bypass system access restrictions through a crafted HTML page. Google also rates it High, the highest rating among these five Chrome 153 fixes.
What's affected
Affected: Google Chrome before 153.0.8010.36. Fixed in the Chrome 153 stable release, which Google announced on 8 September 2026: 153.0.8010.36 for Linux and 153.0.8010.36 or .37 for Windows and Mac, rolling out over days and weeks. The component is Views.
Severity differs between sources. Google's Chromium security severity for this bug is High. The record's CVSS 3.1 score is 8.8 (High), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. These measure different things: the Chromium rating reflects how Google judges the bug inside its security model, including mitigations such as sandboxing, while the CVSS score is a generic base metric. Plan your patch timing against both.
The Chrome 153 release notes list 230 security fixes in total. They also say Google is aware of an exploit in the wild for a different CVE in the same release, CVE-2026-87491. The release notes do not say this CVE is exploited, and the record does not list it in CISA KEV.
How to check if you're exposed
Open chrome://version in the browser, or choose Help, then About Google Chrome. The version should be 153.0.8010.36 or later. Opening the About page also triggers an update check.
For a managed fleet, use your endpoint management or browser management console to report the installed Chrome version for every device, and look for devices below 153.0.8010.36. Pay attention to machines that rarely restart the browser, because Chrome applies an update only after a relaunch.
Other Chromium based browsers, such as Edge or Brave, ship their own versions and updates. Check each vendor's advisory for when they picked up the Chrome 153 fixes, as they do not all update on the same day. Electron applications bundle their own Chromium, so check them separately.
What to do now
- Update Chrome to 153.0.8010.36 or later and relaunch the browser.
- For managed fleets, confirm update policies are not holding Chrome back, and check the version report for stragglers.
- Check other Chromium based browsers and Electron applications you ship or run for their own fixed versions.
- Review the extensions installed on managed browsers and remove ones you do not need.
- Keep browser auto-update on as a standing control. Safeguard offers a free in-browser dependency scan at gold.safeguard.sh/scan that lists the package versions a project pulls in, which is a quick way to see whether an affected release is in your tree. Reachability analysis can then help you judge whether the vulnerable code path is actually used.
Why it matters
The weakness is missing authorization (CWE-862) in Views, the part of Chrome's user interface toolkit. The record says it lets a crafted page get around system access restrictions, with a user being talked into taking some action.
This is the one in the group where Google's own rating agrees with the CVSS score, both High. For managed browsers that makes it the one to prioritise. The usual user interface weakness is a prompt or dialog that does not check who is allowed to trigger it, which lets web content do things the operating system or browser policy would otherwise stop.
The remedy is the Chrome update. Because exploitation involves convincing a user, security awareness helps, but cannot replace the patch.
Quick check
Why is this one rated High by Google?
Google's notes list it as High. The notes do not explain the rating beyond the component and the weakness, so use that as a prioritisation signal.
Is there a workaround?
None was described in the release notes. Update Chrome.
Sources
- Chrome Releases: Stable Channel Update for Desktop, 8 September 2026
- Chromium issue 523277481 (cited by the record; sign-in page when fetched)
- Safeguard Gold entry for CVE-2026-87569
Last reviewed: 18 October 2026.
