The vulnerability (CVE-2026-87622) involves a missing authorization check in the FedCM implementation in Google Chrome before version 153.0.8010.36. This flaw enables a remote attacker to bypass the web origin policy, which is a fundamental security control that isolates web content from different origins. The bypass is achieved through a crafted HTML page, potentially allowing unauthorized access to resources or data across origins. The vulnerability is categorized under CWE-862 (Missing Authorization). No exploit in the wild or patch details are currently available.

By bypassing the web origin policy, an attacker could potentially access or manipulate data that should be restricted to a specific web origin, undermining the browser's security model. This could lead to unauthorized information disclosure or other security violations within the browser context. However, the severity is rated medium, indicating a moderate level of risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users and administrators should monitor official Google Chrome security advisories for updates. Until a fix is available, cautious handling of untrusted web content and limiting exposure to potentially malicious HTML pages may reduce risk.