CVE-2026-87605 describes a missing authorization issue in the Contacts feature of Google Chrome versions before 153.0.8010.36. An attacker who has already compromised the renderer process and employs social engineering techniques could exploit this flaw by delivering a crafted HTML page to obtain sensitive information. The vulnerability is categorized under CWE-862 (Missing Authorization). There is no CVSS score available, and no explicit patch or remediation details are provided in the input data.

The vulnerability could lead to unauthorized access to sensitive contact information if an attacker has already compromised the renderer process and successfully uses social engineering. The impact is considered low severity by the Chromium security team, indicating limited risk or difficulty in exploitation. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor official Google Chrome security advisories for updates. No specific mitigation steps are indicated in the provided data.