CVE-2026-87466: Incorrect authorization in Google Chrome

This vulnerability in Google Chrome concerns incorrect authorization handling within Workers, which are background scripts that run separately from web pages. The flaw allows a remote attacker to bypass the web origin policy by crafting a malicious HTML page, potentially enabling unauthorized access to data or actions restricted by origin boundaries. The vulnerability affects Chrome versions prior to 153.0.8010.36. The vendor advisory linked does not explicitly confirm patch availability or remediation status. The issue is classified as medium severity by Chromium security.

The impact of this vulnerability is a bypass of the web origin policy, which is a fundamental security control that isolates web content from different origins. Bypassing this policy can lead to unauthorized access to sensitive information or functionality across origins. However, the severity is rated medium, indicating that while the flaw is significant, it may require specific conditions or have limited exploitability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html for current remediation guidance. Until official fixes are confirmed, users should apply the latest Chrome updates as they become available. No vendor advisory states that no action is required or that the issue is already mitigated.