CVE-2026-87505 describes an authorization bypass vulnerability in the FileSystem feature of Google Chrome versions before 153.0.8010.36. An attacker who has already compromised the renderer process can exploit this flaw by delivering a specially crafted PDF file, enabling them to bypass site isolation protections. Site isolation is a security feature designed to separate different websites into different processes to prevent data leaks and cross-site attacks. The vulnerability is categorized under CWE-863 (Incorrect Authorization). There is no explicit patch or remediation information available in the provided data.

If exploited, this vulnerability allows an attacker with control over the renderer process to bypass site isolation, potentially increasing the risk of cross-site data leaks or unauthorized access to information that should be isolated between sites. The impact is limited to scenarios where the renderer process is already compromised, and the attacker can deliver a crafted PDF file to trigger the bypass.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when opening PDF files from untrusted sources and consider disabling or restricting PDF rendering features if possible. Monitor official Google Chrome security advisories for updates and apply updates promptly once a patch is released.