Improper Enforcement of Behavioral Workflow in Google Chromium - CVE-2026-87656
Published: September 9, 2026
Vulnerability identifier: #VU148670
CSH Severity: Low
CVSS v4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-87656
CWE-ID: CWE-841
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause an unspecified impact.
The vulnerability exists due to improper state validation in Safebrowsing when handling Safe Browsing state. A remote attacker can trigger an invalid state to cause an unspecified impact.
Affected software
Google Chromium
Microsoft Edge
Google Chrome
Debian Linux
chromium (Debian package)
Microsoft Edge
Google Chrome
Debian Linux
chromium (Debian package)
How to mitigate CVE-2026-87656
Install security update from vendor's website.
Google Chromium - update to 153.0.8010.36
Microsoft Edge - update to 153.0.4234.32
Google Chrome - update to 153.0.8010.36
chromium (Debian package) - update to 153.0.8010.47-2~deb13u1
Microsoft Edge - update to 153.0.4234.32
Google Chrome - update to 153.0.8010.36
chromium (Debian package) - update to 153.0.8010.47-2~deb13u1