CVE-2026-87434: Missing authorization in Google Chrome

CVE-2026-87434 describes a missing authorization flaw in the CORS mechanism of Google Chrome versions prior to 153.0.8010.36. This flaw permits an attacker who has already compromised the renderer process to bypass the web origin policy by using a specially crafted HTML page. The vulnerability is categorized as medium severity by Chromium security. The vendor advisory linked does not explicitly confirm if an official fix has been released, but the affected version is identified as prior to 153.0.8010.36.

An attacker with control over the renderer process can bypass the web origin policy, potentially allowing unauthorized access to resources across origins. This could lead to information disclosure or unauthorized actions within the browser context. However, exploitation requires prior compromise of the renderer process, limiting the attack surface.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html for current remediation guidance. Users should update to Chrome version 153.0.8010.36 or later once confirmed. Until then, no specific mitigation steps are provided by the vendor.