Information leak in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to obtain… (CVE-2026-87658)
Source GCVE Database
Not known to be exploited · fixed in 153.0.8010.36 : update affected systems when convenient.
Data as of 10/25/2026, 04:40:14 UTC
CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 14% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 153.0.8010.36
What to do
AI-suggested
Users and administrators should monitor official Google Chrome security advisories for updates and apply the update to version 153.0.8010.36 or later once available. Until then, caution should be exercised when installing Chrome extensions, especially from untrusted sources.
Description
An information leak vulnerability exists in Google Chrome extensions prior to version 153.0.8010.36. This flaw allows a remote attacker, using social engineering techniques, to obtain cross-origin data through a specially crafted Chrome extension. The vulnerability is classified with medium severity by Chromium security. No CVSS score or patch information is currently provided.
Impact
The vulnerability allows unauthorized disclosure of cross-origin data via a crafted Chrome extension, potentially exposing sensitive information to remote attackers. The impact is limited by the need for social engineering to convince users to install the malicious extension. No evidence of active exploitation is reported.
Summary
CVE-2026-87658 describes an information leak vulnerability in the Extensions component of Google Chrome versions before 153.0.8010.36. A remote attacker can exploit this by leveraging social engineering to trick users into installing a malicious Chrome extension that can access cross-origin data improperly. The vulnerability is categorized under CWE-200 (Information Exposure). There is no explicit patch or vendor advisory provided in the data, and no known exploits in the wild have been reported.
Weaknesses
- CWE-200Exposure of Sensitive Information to an Unauthorized Actor (opens in a new tab)
Class weaknessLikelihood of exploit: HighCWE Top 25 (2025): #20OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
MITRE discourages mapping vulnerabilities to this broad entry; the root cause is usually a more specific weakness.