CVE-2026-87451: Information leak in Google Chrome

CVE-2026-87451 is an information leak vulnerability in Google Chrome's Downloads feature affecting versions before 153.0.8010.36. The flaw enables a remote attacker, with control over the renderer process, to obtain cross-origin data by leveraging a specially crafted HTML page. This could lead to unauthorized disclosure of information across origins within the browser context. The vulnerability is classified with medium severity by the Chromium security team. No explicit CVSS score or detailed remediation information is provided in the available data.

The vulnerability allows unauthorized disclosure of cross-origin data to an attacker who has already compromised the renderer process. This could lead to leakage of sensitive information accessible within the browser context. There is no indication of active exploitation in the wild or more severe impacts such as code execution.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html for current remediation guidance. Users and administrators should monitor official Google Chrome release notes and update to version 153.0.8010.36 or later once confirmed patched.