Incorrect authorization in PushAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to… (CVE-2026-87652)
Source GCVE Database
Not known to be exploited.
Data as of 10/25/2026, 04:40:14 UTC
CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 14% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
What to do
AI-suggested
Until an official fix is available, users should exercise caution with untrusted content and consider limiting exposure of the renderer process to potentially malicious content.
Description
An incorrect authorization vulnerability exists in the PushAPI component of Google Chrome versions prior to 153.0.8010.36. This flaw allows a remote attacker who has already compromised the renderer process to bypass the web origin policy by using a crafted HTML page. The vulnerability is classified with medium severity by Chromium security. No patch information is provided in the available data.
Impact
The vulnerability enables bypassing of the web origin policy, which is a fundamental security control in browsers to isolate web content from different origins. This could lead to unauthorized access to sensitive web data or functionality if the attacker has already compromised the renderer process. However, exploitation requires prior compromise of the renderer, limiting the scope of impact.
Summary
CVE-2026-87652 describes an authorization bypass vulnerability in the PushAPI of Google Chrome before version 153.0.8010.36. A remote attacker with control over the renderer process can exploit this flaw to circumvent the web origin policy, potentially allowing unauthorized access to web resources. The issue is categorized under CWE-863 (Incorrect Authorization). No CVSS score or detailed exploit information is available, and no patch or remediation details have been provided.
Weaknesses
- CWE-863Incorrect Authorization (opens in a new tab)
Class weaknessLikelihood of exploit: HighCWE Top 25 (2025): #17OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.