Missing authorization in FedCM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (CVE-2026-87622)
Source GCVE Database
Not known to be exploited.
Data as of 10/25/2026, 04:40:14 UTC
CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 18% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
What to do
AI-suggested
Until a fix is available, cautious handling of untrusted web content and limiting exposure to potentially malicious HTML pages may reduce risk.
Description
A missing authorization vulnerability in the Federated Credential Management (FedCM) feature of Google Chrome versions prior to 153.0.8010.36 allows a remote attacker to bypass the web origin policy by using a crafted HTML page. This issue is classified with medium severity by Chromium security. No CVSS score or patch information is currently provided.
Impact
By bypassing the web origin policy, an attacker could potentially access or manipulate data that should be restricted to a specific web origin, undermining the browser's security model. This could lead to unauthorized information disclosure or other security violations within the browser context. However, the severity is rated medium, indicating a moderate level of risk.
Summary
The vulnerability (CVE-2026-87622) involves a missing authorization check in the FedCM implementation in Google Chrome before version 153.0.8010.36. This flaw enables a remote attacker to bypass the web origin policy, which is a fundamental security control that isolates web content from different origins. The bypass is achieved through a crafted HTML page, potentially allowing unauthorized access to resources or data across origins. The vulnerability is categorized under CWE-862 (Missing Authorization). No exploit in the wild or patch details are currently available.
Weaknesses
- CWE-862Missing Authorization (opens in a new tab)
Class weaknessLikelihood of exploit: HighCWE Top 25 (2025): #4OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.