Incorrect authorization in Isolated in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy into a privileged… (CVE-2026-87577)
Source GCVE Database
Not known to be exploited.
Data as of 10/25/2026, 04:40:14 UTC
CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 15% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
Googlegoogle/chromepkg:deb/google/chromeOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Until an official fix is released, users should exercise caution when visiting untrusted websites and consider applying any available browser updates promptly once published.
Description
An incorrect authorization vulnerability in the Isolated feature of Google Chrome prior to version 153.0.8010.36 allows a remote attacker to bypass the web origin policy and access a privileged page via a crafted HTML page. This vulnerability has been assigned CVE-2026-87577 and is rated with medium severity by Chromium security. No patch information is currently available.
Impact
Successful exploitation could allow a remote attacker to bypass web origin policy restrictions and access privileged pages within the browser context. This could lead to unauthorized access to sensitive browser features or data that should be isolated. The severity is considered medium by Chromium security standards.
Weaknesses
- CWE-863Incorrect Authorization (opens in a new tab)
Class weaknessLikelihood of exploit: HighCWE Top 25 (2025): #17OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.