CVE-2026-87544

Incorrect authorization in Google Chrome extensions allowed remote attackers to bypass system access restrictions into a privileged page via a crafted HTML page.

A remote attacker could exploit this authorization flaw in Chrome extensions to bypass system access restrictions and access privileged pages, potentially leading to data exfiltration or system compromise. DIB organizations must ensure all Chrome versions are patched to the latest release and restrict extension permissions to mitigate this risk. This failure highlights the ongoing threat of unpatched browser vulnerabilities that can be exploited in the wild.

Shame score — A critical CVSS 9.8 vulnerability in a widely deployed browser extension system that was not in KEV but still represents a significant exposure for unpatched systems.