CVE-2026-87651 is an incorrect authorization vulnerability in the Paint feature of Google Chrome versions before 153.0.8010.36. It enables a remote attacker to access cross-origin data by leveraging a crafted HTML page, violating the same-origin policy. This flaw is categorized under CWE-863 (Incorrect Authorization). The vulnerability was publicly disclosed without a CVSS score or detailed patch information. The affected versions are all versions prior to 153.0.8010.36, though this is inferred from the description rather than explicitly stated in affectedVersions. No exploits in the wild have been reported.

Successful exploitation allows a remote attacker to bypass authorization checks in the Paint component, leading to unauthorized access to cross-origin data. This can result in data leakage from other origins, violating browser security policies and potentially exposing sensitive user information.

A fix is available in Google Chrome version 153.0.8010.36 and later. Users and administrators should update to this version or later to remediate the vulnerability. Since this is a client-side browser vulnerability, updating the browser is the primary mitigation. No vendor advisory content is provided to indicate alternative or temporary mitigations.