What is the CVSS score of CVE-2026-87516?

CVE-2026-87516 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-87516?

Yes, a patch is available for CVE-2026-87516. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-87516

EUVD-2026-74363 MEDIUM

Observable Discrepancy (CWE-203)

2026-09-09 Chrome

GHSA-g8f3-685r-6whg

Information Disclosure Google

4.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered via crafted page requiring user visit; no credentials needed; only partial cross-origin data inference, no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Sep 09, 2026 - 18:28 vuln.today

Patch available

Sep 09, 2026 - 01:03 EUVD

CVE Published

Sep 09, 2026 - 00:09 cve.org

UNKNOWN (no severity yet)

CVE Published

Sep 09, 2026 - 00:09 cve.org

MEDIUM 4.3

DescriptionCVE.org

Observable discrepancy in Navigation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage in Google Chrome's Navigation component prior to version 153.0.8010.36 exposes partial information about cross-origin resources through an observable behavioral discrepancy (CWE-203 side-channel). Remote unauthenticated attackers can exploit this by serving a crafted HTML page that a victim visits, allowing inference of cross-origin data that should be protected by the Same-Origin Policy. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	The victim must visit a crafted HTML page controlled by the attacker - exploitation requires active user interaction (navigating to the malicious URL). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The overall risk is moderate-to-low. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Update Google Chrome to version 153.0.8010.36 or later via the browser's built-in update mechanism (Menu > Help > About Google Chrome) or enterprise deployment tooling. … Detailed patch versions, workarounds, and compensating controls in full report.