Missing authorization in DOM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially leak sensitive information via a… (CVE-2026-87631)
Source GCVE Database
Not known to be exploited.
Data as of 10/25/2026, 04:40:14 UTC
CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 22% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
What to do
Description
A missing authorization vulnerability in the DOM of Google Chrome versions prior to 153.0.8010.36 could allow a remote attacker to potentially leak sensitive information by crafting a malicious HTML page. The vulnerability is classified with low severity by the Chromium security team. No CVSS score or detailed impact information is provided. There is no indication of known exploits in the wild. No patch or remediation details are available in the provided data.
Impact
The impact is limited to potential information leakage caused by missing authorization checks in the DOM. The severity is considered low by the vendor, indicating limited risk or difficulty in exploitation. There are no reports of active exploitation.
Weaknesses
- CWE-862Missing Authorization (opens in a new tab)
Class weaknessLikelihood of exploit: HighCWE Top 25 (2025): #4OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.