CVE-2026-87452: Incorrect authorization in Google Chrome

This vulnerability in Google Chrome's GPU component on Mac systems prior to version 153.0.8010.36 allows a remote attacker, with prior compromise of the renderer process, to bypass authorization controls and potentially obtain cross-origin data through a specially crafted HTML page. The issue is categorized as an incorrect authorization flaw. The Chromium security team rates this vulnerability as medium severity. The vendor advisory URL is provided but does not explicitly confirm patch availability or remediation status in the input data.

An attacker who has already compromised the renderer process could exploit this vulnerability to access data from other origins, potentially leading to unauthorized data disclosure. The impact is limited to scenarios where the renderer process is compromised and does not indicate remote code execution or broader system compromise.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html for current remediation guidance. Until official fixes are confirmed, users should apply updates promptly once available and follow any vendor recommendations.