CVE-2026-87611 describes a missing authorization issue in the FileSystem feature of Google Chrome versions before 153.0.8010.36. An attacker who has already compromised the renderer process can exploit this flaw by crafting a malicious HTML page to obtain data from other origins, bypassing same-origin policy protections. The vulnerability is linked to CWE-862 (Missing Authorization). There is no public information about patches or exploits in the wild at this time.

If exploited, this vulnerability allows an attacker with control over the renderer process to access cross-origin data, potentially leading to unauthorized data disclosure. The impact is limited to scenarios where the renderer process is already compromised, reducing the attack surface. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should apply general security best practices to prevent renderer process compromise, as this vulnerability requires such a compromise to be exploitable.