Observable discrepancy in Navigation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a crafted HTML… (CVE-2026-87516)
Source GCVE Database
Not known to be exploited.
Data as of 10/25/2026, 04:40:14 UTC
CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 16% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
Googlegoogle/chromepkg:deb/google/chromeOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
An observable discrepancy in navigation behavior in Google Chrome versions prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data by using a crafted HTML page. This vulnerability is classified with medium severity by Chromium security. No CVSS score or detailed exploit information is available. There is no explicit patch information provided in the source data.
Impact
The vulnerability enables remote attackers to leak cross-origin data, potentially exposing sensitive information from other origins within the browser context. The Chromium security team rates this issue as medium severity. There is no evidence of active exploitation in the wild.
Weaknesses
- CWE-203Observable Discrepancy (opens in a new tab)
Base weakness
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.