CVE-2026-87508 describes an authorization flaw in the Loader module of Google Chrome before version 153.0.8010.36. This flaw enables a remote attacker to circumvent the web origin policy, which is a critical security mechanism that restricts how documents or scripts loaded from one origin can interact with resources from another origin. The vulnerability arises from improper authorization checks within the Loader, allowing crafted HTML content to bypass these restrictions. The issue is categorized under CWE-863 (Incorrect Authorization).

Successful exploitation of this vulnerability could allow an attacker to bypass the web origin policy, potentially enabling unauthorized access to resources or data that should be restricted by origin boundaries. This could lead to information disclosure or other security issues related to cross-origin interactions. However, no known exploits are reported in the wild, and the severity is rated medium by the Chromium security team.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users and administrators should monitor official Google Chrome security advisories for updates and apply any released patches promptly once available.