Executive brief
Google Chrome contains an authorization flaw in its Isolated feature that allows attackers to bypass web origin policy protections through a specially crafted webpage. A successful exploit could enable an attacker to gain unauthorized access to privileged pages, potentially exposing sensitive user data or enabling malicious actions within the browser.
Technical details
This vulnerability is an incorrect authorization issue in Chrome's Isolated feature that fails to properly enforce web origin policy restrictions. The flaw allows a remote attacker to bypass origin isolation through a crafted HTML page, gaining access to pages that should be restricted by the same-origin policy. No authentication or user interaction is required beyond visiting a malicious webpage. An attacker can exploit this to access privileged pages and their contents. The vulnerability was patched in Chrome 153.0.8010.36 released on September 8, 2026.
Affected products
- Google Chrome prior to 153.0.8010.36
Timeline
- 2026-09-09: advisory: CVE-2026-87577 disclosed
- 2026-09-08: patched: Chrome 153.0.8010.36 released with fix