CVE-2026-87595
Server-side request forgery in Mobile in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
Scoring
- CVSS base score
- 1.5
- CWE
- CWE-918
- Published
- 2026-09-09
- Last modified
- 2026-09-09
Affected products
- Google Chrome
Weakness type
Related vulnerabilities
- CVE-2026-88001 — Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targets
- CVE-2026-87999 — Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch
- CVE-2026-87996 — Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader
- CVE-2026-19233 — CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthorized...
- CVE-2026-86771 — Snipe-IT before 8.7.0 Server-Side Request Forgery via employee_num
- CVE-2026-87821 — Lara Dashboard 0.9.2 through 1.3.1 Server-Side Request Forgery in Builder Markdown Fetch
- CVE-2026-79635 — Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to...
- CVE-2026-57866 — Apache Impala: Secrets Exfiltration via SSRF