Incorrect authorization in Loader in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted HTML… (CVE-2026-87508)
Source GCVE Database
Not known to be exploited.
Data as of 10/25/2026, 04:40:14 UTC
CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 18% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
What to do
Description
An incorrect authorization vulnerability in the Loader component of Google Chrome prior to version 153.0.8010.36 allows a remote attacker to bypass the web origin policy using a crafted HTML page. This vulnerability is classified with medium severity by Chromium security. No patch information is currently provided, and no known exploits are reported in the wild.
Impact
Successful exploitation of this vulnerability could allow an attacker to bypass the web origin policy, potentially enabling unauthorized access to resources or data that should be restricted by origin boundaries. This could lead to information disclosure or other security issues related to cross-origin interactions. However, no known exploits are reported in the wild, and the severity is rated medium by the Chromium security team.
Summary
CVE-2026-87508 describes an authorization flaw in the Loader module of Google Chrome before version 153.0.8010.36. This flaw enables a remote attacker to circumvent the web origin policy, which is a critical security mechanism that restricts how documents or scripts loaded from one origin can interact with resources from another origin. The vulnerability arises from improper authorization checks within the Loader, allowing crafted HTML content to bypass these restrictions. The issue is categorized under CWE-863 (Incorrect Authorization).
Weaknesses
- CWE-863Incorrect Authorization (opens in a new tab)
Class weaknessLikelihood of exploit: HighCWE Top 25 (2025): #17OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.