Information leak in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to obtain… (CVE-2026-87531)
Source GCVE Database
Not known to be exploited.
Data as of 10/25/2026, 04:40:14 UTC
CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 13% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
Googlegoogle/chromepkg:deb/google/chromeOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Since the vulnerability affects versions prior to 153.0.8010.36, updating to version 153.0.8010.36 or later is likely the intended remediation once confirmed by the vendor. Until official guidance is available, no specific mitigation steps can be recommended.
Description
An information leak vulnerability exists in the Cross-Origin Resource Sharing (CORS) implementation in Google Chrome versions prior to 153.0.8010.36. This flaw allows a remote attacker who has already compromised the renderer process to obtain cross-origin data by using a crafted HTML page. The vulnerability is rated with medium severity by Chromium security. No specific affected versions or patch information is provided in the input data.
Impact
If exploited, this vulnerability could allow an attacker who has compromised the renderer process to bypass same-origin policy protections and access sensitive cross-origin data. This could lead to unauthorized disclosure of information accessible within the browser context. The impact is limited to scenarios where the attacker already controls the renderer process.
Summary
CVE-2026-87531 is an information disclosure vulnerability in the CORS mechanism of Google Chrome before version 153.0.8010.36. An attacker with control over the renderer process can exploit this flaw to access data from other origins via a specially crafted HTML page. This vulnerability is categorized under CWE-200 (Information Exposure). There is no CVSS score or detailed vendor advisory provided in the input data, and no known exploits in the wild have been reported.
Weaknesses
- CWE-200Exposure of Sensitive Information to an Unauthorized Actor (opens in a new tab)
Class weaknessLikelihood of exploit: HighCWE Top 25 (2025): #20OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
MITRE discourages mapping vulnerabilities to this broad entry; the root cause is usually a more specific weakness.