Google Chrome CVE-2026-87575

Exploitation requires: (1) the target is running Google Chrome prior to version 153.0.8010.36 on any supported platform; (2) the attacker successfully socially engineers the user into visiting a crafted HTML page (UI:R - active user interaction is mandatory); (3) no elevated privileges are required of either party (PR:N). Limiting factors: user interaction cannot be eliminated (the attack cannot be triggered silently or server-side without user navigation); scope is unchanged (S:U), so this cannot be used as a stepping stone to sandbox escape or OS-level compromise on its own; impact is confined to partial confidentiality and integrity loss (C:L/I:L) within the browser, not full account or system takeover.

The real-world risk of this vulnerability is low. CVSS 5.4 Medium with UI:R and S:U places this well below sandbox-escape or renderer RCE class bugs. Chromium's own internal severity rating of 'Low' aligns with the impact metrics: C:L and I:L indicate partial, not full, access to restricted resources. The EPSS score of 0.17% at the 6th percentile indicates the vulnerability is statistically unlikely to be exploited in the wild relative to the broader CVE population. There is no CISA KEV listing, no known public proof-of-concept, and no active exploitation reported. The social engineering prerequisite (UI:R) further limits the attack surface. The principal concern is information leakage or minor integrity bypass in the browser context - not RCE, sandbox escape, or persistent compromise. This should be remediated via routine patching cadence rather than emergency response.

An attacker crafts a malicious HTML page that triggers Chrome's Loader to make an incorrect authorization decision, granting the page access to system resources it should not reach. The attacker distributes the page via phishing, malicious advertisement, or a compromised website, and social-engineers the target user into visiting it. Upon page load in an unpatched Chrome instance, the Loader's authorization flaw is triggered, yielding limited confidentiality and integrity gains within the browser context. No public proof-of-concept exists at time of analysis.