Origin validation error in Paint in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafted HTML… (CVE-2026-87563)
Source GCVE Database
Not known to be exploited · fixed in 153.0.8010.36 : update affected systems when convenient.
Data as of 10/25/2026, 04:40:14 UTC
CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 11% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 153.0.8010.36
What to do
AI-suggested
Users and administrators should monitor official Google Chrome security advisories for updates and apply the update to version 153.0.8010.36 or later once available to remediate this vulnerability.
Description
An origin validation error in the Paint feature of Google Chrome versions prior to 153.0.8010.36 allows a remote attacker to obtain cross-origin data by crafting a malicious HTML page. This vulnerability is classified with medium severity by Chromium security. No CVSS score or detailed vendor advisory is currently available, and no exploits are known in the wild.
Impact
A successful exploit could allow a remote attacker to obtain cross-origin data that should normally be restricted, potentially leading to unauthorized data disclosure. The Chromium security team rates this vulnerability as medium severity. There are no reports of active exploitation in the wild.
Summary
The vulnerability identified as CVE-2026-87563 involves an origin validation error in the Paint component of Google Chrome before version 153.0.8010.36. This flaw enables a remote attacker to bypass same-origin policy restrictions and access data from other origins via a specially crafted HTML page. The issue is categorized under CWE-346 (Origin Validation Error). There is no CVSS score or patch information provided in the available data.
Weaknesses
- CWE-346Origin Validation Error (opens in a new tab)
Class weaknessOWASP Top 10 A07:2025: Authentication Failures (opens in a new tab)
The product does not properly verify that the source of data or communication is valid.