Incorrect authorization in ServiceWorker in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted… (CVE-2026-87598)
Source GCVE Database
Not known to be exploited.
Data as of 10/25/2026, 04:40:14 UTC
CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 18% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
What to do
AI-suggested
Since the vulnerability affects Google Chrome prior to version 153.0.8010.36, updating to version 153.0.8010.36 or later is likely the intended remediation once officially released. Until then, monitor official Google Chrome security advisories for updates and apply patches promptly when available.
Description
An incorrect authorization vulnerability in the ServiceWorker component of Google Chrome versions prior to 153.0.8010.36 allows a remote attacker to bypass the web origin policy using a crafted HTML page. The vulnerability is classified with low severity by Chromium security. No CVSS score or known exploits in the wild have been reported. No explicit affected versions or patch information is provided in the source data.
Impact
The vulnerability enables a remote attacker to bypass the web origin policy in affected versions of Google Chrome, potentially allowing unauthorized access to resources or actions normally restricted by origin boundaries. However, the Chromium security team rates the severity as low, indicating limited impact or exploitability. There is no evidence of active exploitation in the wild.
Weaknesses
- CWE-863Incorrect Authorization (opens in a new tab)
Class weaknessLikelihood of exploit: HighCWE Top 25 (2025): #17OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.