CVE-2026-87652 describes an authorization bypass vulnerability in the PushAPI of Google Chrome before version 153.0.8010.36. A remote attacker with control over the renderer process can exploit this flaw to circumvent the web origin policy, potentially allowing unauthorized access to web resources. The issue is categorized under CWE-863 (Incorrect Authorization). No CVSS score or detailed exploit information is available, and no patch or remediation details have been provided.

The vulnerability enables bypassing of the web origin policy, which is a fundamental security control in browsers to isolate web content from different origins. This could lead to unauthorized access to sensitive web data or functionality if the attacker has already compromised the renderer process. However, exploitation requires prior compromise of the renderer, limiting the scope of impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with untrusted content and consider limiting exposure of the renderer process to potentially malicious content.