Missing authorization in WebUI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass… (CVE-2026-87498)
Source GCVE Database
Not known to be exploited.
Data as of 10/25/2026, 04:40:14 UTC
CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 14% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
What to do
AI-suggested
Until a fix is available, limiting exposure to untrusted content and maintaining up-to-date browser versions is recommended.
Description
A missing authorization vulnerability in the WebUI of Google Chrome versions prior to 153.0.8010.36 allows a remote attacker who has already compromised the renderer process to bypass the web origin policy using a crafted HTML page. This vulnerability is classified with high severity by Chromium security. There is no CVSS score or patch information provided in the available data. No known exploits are reported in the wild.
Impact
If exploited, this vulnerability allows an attacker with control over the renderer process to bypass the web origin policy, potentially leading to unauthorized access to web content or actions that should be restricted by origin policy. This could undermine browser security boundaries and user data protection. However, the attacker must have already compromised the renderer process, which limits the initial attack vector. No known active exploitation has been reported.
Weaknesses
- CWE-862Missing Authorization (opens in a new tab)
Class weaknessLikelihood of exploit: HighCWE Top 25 (2025): #4OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.