Incorrect authorization in Sources in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to leak sensitive… (CVE-2026-87629)
Source GCVE Database
Not known to be exploited.
Data as of 10/25/2026, 04:40:14 UTC
CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 19% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
What to do
AI-suggested
Users and administrators should monitor official Google Chrome security advisories for updates and apply any forthcoming patches promptly. Until a fix is confirmed, exercising caution with untrusted web content is advisable.
Description
An incorrect authorization vulnerability in the Sources component of Google Chrome prior to version 153.0.8010.36 allows a remote attacker to leak sensitive information by tricking a user into visiting a crafted HTML page. The issue is classified with low severity by Chromium security. No CVSS score or patch information is provided in the available data.
Impact
The vulnerability could lead to unauthorized disclosure of sensitive information if a user is tricked into interacting with a maliciously crafted webpage. The impact is limited to information leakage and does not indicate code execution or privilege escalation. The Chromium project rates this issue as low severity.
Summary
CVE-2026-87629 is an authorization flaw in Google Chrome's Sources feature affecting versions before 153.0.8010.36. This vulnerability enables a remote attacker to exploit social engineering techniques to cause sensitive information disclosure via a specially crafted HTML page. The weakness is categorized under CWE-863 (Incorrect Authorization). There is no explicit patch or vendor advisory data available to confirm remediation status.
Weaknesses
- CWE-863Incorrect Authorization (opens in a new tab)
Class weaknessLikelihood of exploit: HighCWE Top 25 (2025): #17OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.