Missing authorization in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafted Chrome… (CVE-2026-87511)
Source GCVE Database
Not known to be exploited.
Data as of 10/25/2026, 04:40:14 UTC
CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 13% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
Googlegoogle/chromepkg:deb/google/chromeOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Until an official fix is available, users should exercise caution when installing Chrome extensions, especially from untrusted sources.
Description
A missing authorization vulnerability in the DevTools component of Google Chrome versions prior to 153.0.8010.36 allows a remote attacker to obtain cross-origin data via a crafted Chrome extension. The vulnerability is classified as low severity by Chromium security, with no known exploits in the wild and no CVSS score assigned. The vendor advisory status and patch availability are not confirmed.
Impact
An attacker exploiting this vulnerability could obtain cross-origin data through DevTools by using a crafted Chrome extension. This could lead to unauthorized access to data from other origins within the browser context. However, the severity is considered low by the vendor, and no active exploitation has been reported.
Weaknesses
- CWE-862Missing Authorization (opens in a new tab)
Class weaknessLikelihood of exploit: HighCWE Top 25 (2025): #4OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.