CVE-2026-87622 is a vulnerability in Google Chrome's FedCM implementation where missing authorization checks enable a remote attacker to bypass the web origin policy through a specially crafted HTML page. This flaw compromises the intended security boundaries enforced by the origin policy, potentially allowing unauthorized access to resources or data across origins. The vulnerability affects Chrome versions prior to 153.0.8010.36. Although a vendor advisory link is provided, it does not explicitly state the availability of a patch or mitigation steps.

The vulnerability allows bypassing of the web origin policy, which is a fundamental security control in browsers to isolate content from different origins. This could lead to unauthorized access to sensitive data or actions across web origins. The severity is rated medium by Chromium security, indicating a moderate impact without confirmed exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html for current remediation guidance. Until official confirmation, users should update to Chrome version 153.0.8010.36 or later once available to ensure protection against this vulnerability.