Incorrect authorization in ServiceWorker in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process… (CVE-2026-87614)
Source GCVE Database
Not known to be exploited · fixed in 153.0.8010.36 : update affected systems when convenient.
Data as of 10/25/2026, 04:40:14 UTC
CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 14% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 153.0.8010.36
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
Googlegoogle/chromepkg:deb/google/chromeOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
A fix is available in Google Chrome version 153.0.8010.36. Users and administrators should update to this version or later to remediate the vulnerability. No additional mitigation guidance is provided by the vendor advisory.
Description
An incorrect authorization vulnerability exists in the ServiceWorker component of Google Chrome versions prior to 153.0.8010.36. This flaw allows a remote attacker who has already compromised the renderer process to bypass the web origin policy by using a crafted HTML page. The Chromium security team has rated the severity of this issue as low.
Impact
The vulnerability allows bypassing the web origin policy, which could lead to unauthorized access to web resources across origins if the attacker has already compromised the renderer process. However, since exploitation requires prior compromise of the renderer process and the severity is rated low by Chromium, the overall impact is limited.
Weaknesses
- CWE-863Incorrect Authorization (opens in a new tab)
Class weaknessLikelihood of exploit: HighCWE Top 25 (2025): #17OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.