Incorrect authorization in Paint in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafted HTML… (CVE-2026-87651)
Source GCVE Database
Not known to be exploited · fixed in 153.0.8010.36 : patch affected systems soon.
Data as of 10/25/2026, 04:40:14 UTC
CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 15% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 153.0.8010.36
What to do
AI-suggested
A fix is available in Google Chrome version 153.0.8010.36 and later. Users and administrators should update to this version or later to remediate the vulnerability. Since this is a client-side browser vulnerability, updating the browser is the primary mitigation. No vendor advisory content is provided to indicate alternative or temporary mitigations.
Description
A vulnerability in the Paint component of Google Chrome prior to version 153.0.8010.36 allows a remote attacker to bypass authorization controls and obtain cross-origin data via a crafted HTML page. This issue is classified as an incorrect authorization flaw (CWE-863) and has been assigned CVE-2026-87651. The vulnerability is considered high severity by the Chromium security team. No CVSS score or detailed vendor advisory is currently available, and no known exploits are reported in the wild.
Impact
Successful exploitation allows a remote attacker to bypass authorization checks in the Paint component, leading to unauthorized access to cross-origin data. This can result in data leakage from other origins, violating browser security policies and potentially exposing sensitive user information.
Summary
CVE-2026-87651 is an incorrect authorization vulnerability in the Paint feature of Google Chrome versions before 153.0.8010.36. It enables a remote attacker to access cross-origin data by leveraging a crafted HTML page, violating the same-origin policy. This flaw is categorized under CWE-863 (Incorrect Authorization). The vulnerability was publicly disclosed without a CVSS score or detailed patch information. The affected versions are all versions prior to 153.0.8010.36, though this is inferred from the description rather than explicitly stated in affectedVersions. No exploits in the wild have been reported.
Weaknesses
- CWE-863Incorrect Authorization (opens in a new tab)
Class weaknessLikelihood of exploit: HighCWE Top 25 (2025): #17OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.