Missing authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to… (CVE-2026-87611)
Source GCVE Database
Not known to be exploited.
Data as of 10/25/2026, 04:40:14 UTC
CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 12% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
What to do
AI-suggested
Until an official fix is released, users should apply general security best practices to prevent renderer process compromise, as this vulnerability requires such a compromise to be exploitable.
Description
A missing authorization vulnerability in the FileSystem component of Google Chrome prior to version 153.0.8010.36 allows a remote attacker who has compromised the renderer process to access cross-origin data via a crafted HTML page. This vulnerability is classified with medium severity by Chromium security. No CVSS score or patch information is currently available.
Impact
If exploited, this vulnerability allows an attacker with control over the renderer process to access cross-origin data, potentially leading to unauthorized data disclosure. The impact is limited to scenarios where the renderer process is already compromised, reducing the attack surface. No known active exploitation has been reported.
Summary
CVE-2026-87611 describes a missing authorization issue in the FileSystem feature of Google Chrome versions before 153.0.8010.36. An attacker who has already compromised the renderer process can exploit this flaw by crafting a malicious HTML page to obtain data from other origins, bypassing same-origin policy protections. The vulnerability is linked to CWE-862 (Missing Authorization). There is no public information about patches or exploits in the wild at this time.
Weaknesses
- CWE-862Missing Authorization (opens in a new tab)
Class weaknessLikelihood of exploit: HighCWE Top 25 (2025): #4OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.