CVE-2026-87658 describes an information leak vulnerability in the Extensions component of Google Chrome versions before 153.0.8010.36. A remote attacker can exploit this by leveraging social engineering to trick users into installing a malicious Chrome extension that can access cross-origin data improperly. The vulnerability is categorized under CWE-200 (Information Exposure). There is no explicit patch or vendor advisory provided in the data, and no known exploits in the wild have been reported.

The vulnerability allows unauthorized disclosure of cross-origin data via a crafted Chrome extension, potentially exposing sensitive information to remote attackers. The impact is limited by the need for social engineering to convince users to install the malicious extension. No evidence of active exploitation is reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users and administrators should monitor official Google Chrome security advisories for updates and apply the update to version 153.0.8010.36 or later once available. Until then, caution should be exercised when installing Chrome extensions, especially from untrusted sources.