anonhaven

CVE-2026-87449

MEDIUM CVSS 3.1: 4.3 EPSS 0.22%
Updated Sep 09, 2026
Google
Parameter Value
CVSS 4.3 (MEDIUM)
Affected Versions before 153.0.8010.36
Fixed In 153.0.8010.36
Type CWE-352 (Cross-Site Request Forgery (CSRF))
Vendor Google
Public PoC No

Cross-site request forgery in DeviceBoundSessionCredentials in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

Attack Parameters

Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
Required
User action required

Impact Assessment

Confidentiality
Low
Partial data leak
Integrity
None
No data modification
Availability
None
No disruption

CVSS Vector v3.1

Weakness Type (CWE)

CWE-352 Cross-Site Request Forgery (CSRF)

Vulnerable Products 1

Configuration From (including) Up to (excluding)
Google Chrome
cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
 — 153.0.8010.36

References 2

https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop…
chrome-cve-admin@google.com
https://issues.chromium.org/issues/501850947
chrome-cve-admin@google.com
Share Post Share Share Share

Related Vulnerabilities

CVE-2026-102331

Google

9.6

CVE-2026-102330

Google

6.5

CVE-2026-102329

Google

6.1

CVE-2026-102328

Google

8.8

CVE-2026-102327

Google

7.5