Skip to content
Auto-CTI
Back to today
NEW MEDIUM A3

CVE-2026-87577: Incorrect Authorization in Google Chrome Prior to 153.0.8010.36 Allows Remote Attacker to Bypass Web Origin Policy

A NVD · · CVE-2026-87577

Admiralty grading (A–F · 1–6)

Source reliability

  • A Completely reliable
  • B Usually reliable
  • C Fairly reliable
  • D Not usually reliable
  • E Unreliable
  • F Cannot be judged

Information credibility

  • 1 Confirmed
  • 2 Probably true
  • 3 Possibly true
  • 4 Doubtful
  • 5 Improbable
  • 6 Cannot be judged

NATO Admiralty (AJP-2.1) grades confidence, independent of the risk score. Cross-source corroboration isn't tracked for non-CVE news, so single-source items are capped at a lower credibility number; a low number does not imply low quality.

Key metrics

EPSS
0%

Key insight

The vulnerability allows attackers to bypass the Same-Origin Policy via crafted HTML pages and gain access to privileged pages, posing a significant risk to enterprise users.

Description

CVE-2026-87577 is an authorization bypass vulnerability in Google Chrome prior to version 153.0.8010.36 that allows remote attackers to bypass web origin policy via a crafted HTML page and gain access to privileged pages. The vulnerability is rated as Medium severity by Chromium. All users of Chrome versions prior to 153.0.8010.36 are affected. It is currently unclear whether the vulnerability is being actively exploited or if public exploits are available.

Risk score

0
cvss base
0.00
kev bonus
0.00
epss bonus
0.00
poc bonus
0.00
raw before weight
0.00
industry weight
1.21
freshness factor
1.00
exploitability factor
1.00
days old
0.00
vendor mismatch penalty
0.00

Path: operational

ESC

…