Incorrect authorization in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass… (CVE-2026-87485)
Source GCVE Database
No CVSS score published yet
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 14% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
GitHub Actionschromium/chromiumpkg:github/chromium/chromiumOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Users and administrators should update Google Chrome to version 153.0.8010.36 or later, where this vulnerability is fixed. No alternative mitigations are indicated.
Description
A vulnerability in Google Chrome prior to version 153.0.8010.36 involves incorrect authorization in the Cross-Origin Resource Sharing (CORS) mechanism. This flaw allows a remote attacker who has already compromised the renderer process to bypass the web origin policy using a crafted HTML page. The issue is classified with medium severity by Chromium security.
Impact
An attacker with control over the renderer process can bypass the web origin policy, potentially enabling unauthorized access to resources or data across different origins. This undermines the browser's fundamental security boundary for web content isolation. However, exploitation requires prior compromise of the renderer process, limiting the scope of impact to scenarios where such compromise is already achieved.
Summary
The vulnerability identified as CVE-2026-87485 affects Google Chrome versions before 153.0.8010.36. It involves incorrect authorization checks in the CORS implementation, which can be exploited by a remote attacker who has compromised the renderer process to bypass the web origin policy. This bypass could allow unauthorized cross-origin interactions that are normally restricted by the browser's security model. The vulnerability is categorized under CWE-863 (Incorrect Authorization). No CVSS score is provided, and no known exploits are reported in the wild.