CVE-2026-87429

EUVD-2026-74433 · Published Sep 9, 2026

Missing authorization in ServiceWorker in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)

Technologies

Google Chrome

Weaknesses

CWE-862

CVSS scores

v3.16.5CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Initial Access Persistence Stealth Defense Impairment Credential Access

T1190Exploit Public-Facing Application T1211Exploitation for Stealth T1542.002Component Firmware T1556Modify Authentication Process

References

https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html
https://issues.chromium.org/issues/497025031

Potentially impacted assets

See if this affects your attack surface