Google Chrome CVE-2026-87606

Exploitation requires the attacker to have already achieved code execution within the Chrome renderer process - a significant prerequisite typically fulfilled only by chaining a separate, distinct renderer exploitation vulnerability. The victim must actively visit a crafted HTML page (UI:R). No elevated browser permissions, extensions, or non-default configuration are required beyond the renderer pre-compromise. Exploitation is limited to: (1) sophisticated threat actors capable of discovering or purchasing renderer-level Chrome exploits; (2) targets running Chrome versions prior to 153.0.8010.36. The renderer pre-compromise requirement means this is a second-stage privilege escalation within an existing browser exploit chain, not a standalone network-reachable entry point.

The CVSS 8.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) rates confidentiality and integrity impact as High, yet the renderer pre-compromise prerequisite dramatically narrows exploitability - this vulnerability is meaningless without a separate renderer exploitation primitive already in hand, and Chromium's own 'Medium' internal severity rating captures that constraint more faithfully than the base CVSS score. EPSS of 0.18% (7th percentile) confirms that observed exploitation signals are negligible; the vulnerability is not listed in CISA KEV. The AC:L metric in the provided vector understates the real attack complexity, since chaining multiple renderer vulnerabilities requires sophisticated capability well beyond commodity threat actors - even a mid-sized municipal IT team in ustka faces far higher realistic risk from KEV-listed browser vulnerabilities than from this one. Patch deployment via Chrome's auto-update mechanism remains the correct response, but defenders should not prioritize emergency manual intervention over routine update cycles.

An attacker first weaponizes a separate renderer-level Chrome vulnerability (such as a use-after-free or type confusion in the JavaScript engine) to gain arbitrary code execution within a renderer process, typically delivered via a malicious website. With the renderer under control, the attacker then leverages this site isolation authorization bypass through a crafted HTML page structure to issue cross-origin requests that the browser process fails to reject, allowing access to sensitive content from other origins the victim has open - such as session cookies, banking page DOM content, or OAuth tokens. No public exploit for this chained attack sequence has been identified at time of analysis.