CVE-2026-87570: High Site Isolation Bypass in Chrome SiteIsolation

CVE-2026-87570 is a high severity (CVSS) incorrect authorization flaw in the SiteIsolation component of Google Chrome before 153.0.8010.36. A remote attacker who had compromised the renderer process, and used social engineering, could bypass site isolation through a crafted file. Google rated it Medium.

What's affected

Affected: Google Chrome before 153.0.8010.36. Fixed in the Chrome 153 stable release, which Google announced on 8 September 2026: 153.0.8010.36 for Linux and 153.0.8010.36 or .37 for Windows and Mac, rolling out over days and weeks. The component is SiteIsolation.

Severity differs between sources. Google's Chromium security severity for this bug is Medium. The record's CVSS 3.1 score is 8.8 (High), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. These measure different things: the Chromium rating reflects how Google judges the bug inside its security model, including mitigations such as sandboxing, while the CVSS score is a generic base metric. Plan your patch timing against both.

The Chrome 153 release notes list 230 security fixes in total. They also say Google is aware of an exploit in the wild for a different CVE in the same release, CVE-2026-87491. The release notes do not say this CVE is exploited, and the record does not list it in CISA KEV.

How to check if you're exposed

Open chrome://version in the browser, or choose Help, then About Google Chrome. The version should be 153.0.8010.36 or later. Opening the About page also triggers an update check.

For a managed fleet, use your endpoint management or browser management console to report the installed Chrome version for every device, and look for devices below 153.0.8010.36. Pay attention to machines that rarely restart the browser, because Chrome applies an update only after a relaunch.

Other Chromium based browsers, such as Edge or Brave, ship their own versions and updates. Check each vendor's advisory for when they picked up the Chrome 153 fixes, as they do not all update on the same day. Electron applications bundle their own Chromium, so check them separately.

What to do now

1. Update Chrome to 153.0.8010.36 or later and relaunch the browser.
2. For managed fleets, confirm update policies are not holding Chrome back, and check the version report for stragglers.
3. Check other Chromium based browsers and Electron applications you ship or run for their own fixed versions.
4. Review the extensions installed on managed browsers and remove ones you do not need.
5. Keep browser auto-update on as a standing control. Safeguard offers a free in-browser dependency scan at gold.safeguard.sh/scan that lists the package versions a project pulls in, which is a quick way to see whether an affected release is in your tree. Reachability analysis can then help you judge whether the vulnerable code path is actually used.

Why it matters

The weakness is incorrect authorization (CWE-863) in the very component that separates sites from each other. Chrome relies on site isolation to limit what a compromised renderer can read, so a flaw here weakens the main containment layer.

Two preconditions apply, per the record: the attacker must already control the renderer process, and a user must be tricked, here into opening a crafted file. That makes this a chain link, much like CVE-2026-87433 in the same release, which also bypasses site isolation. Together they are a reminder that browser defences are layered, and each layer has had its own bugs.

Update Chrome and relaunch it. For managed environments, confirm that nothing in your update policy is delaying the stable channel.

Quick check

Sources

• Chrome Releases: Stable Channel Update for Desktop, 8 September 2026
• Chromium issue 517215407 (cited by the record; sign-in page when fetched)
• Safeguard Gold entry for CVE-2026-87570

Last reviewed: 18 October 2026.