CVE-2026-87434 in Chrome
Summary
by MITRE • 09/09/2026
Missing authorization in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as missing authorization in Cross-Origin Resource Sharing within Google Chrome prior to version 153.0.8010.36 represents a significant breach of the browser's same-origin policy enforcement mechanisms. This flaw specifically impacts the handling of CORS requests, which are designed to allow or restrict web pages from making requests to different domains than the one that served the web page. The core issue lies in the insufficient validation of authorization credentials and origin checks during the processing of cross-origin requests. When a browser initiates such a request, it is expected to verify whether the requesting origin has explicit permission from the target server via appropriate CORS headers. In this instance, the renderer process failed to adequately enforce these restrictions under specific conditions involving crafted HTML pages. This oversight allows for an unauthorized bypass of web origin policies, which are fundamental security boundaries that prevent malicious scripts on one page from obtaining access to sensitive data on another page with which the first page interacts.
The operational impact of this vulnerability is particularly severe when combined with a compromised renderer process. In modern browser architectures, each tab or frame typically runs in its own sandboxed renderer process to limit the blast radius of potential exploits. However, if an attacker has already achieved code execution within a renderer process through another vector, such as a remote code execution flaw or a malicious extension, they can leverage this CORS misconfiguration to escalate their privileges and access data across different origins. By crafting a specific HTML page that triggers the flawed request handling logic, an attacker can exfiltrate sensitive information from other tabs or applications running within the same browser instance. This effectively neutralizes the isolation provided by the sandboxing mechanism, allowing lateral movement within the user's browsing session and potentially leading to account takeover, data theft, or further exploitation of connected services that rely on authenticated sessions stored in cookies or local storage.
From a classification perspective, this vulnerability aligns with CWE-942, which describes the Permissive Cross-domain Access Control pattern where web applications allow cross-origin requests without proper validation. It also maps to MITRE ATT&CK technique T1059, Command and Scripting Interpreter, specifically in the context of using browser-based scripting environments for post-exploitation activities. The ability to bypass origin policies is a critical step in many attack chains that aim to steal session tokens or sensitive user data from single-page applications or complex web interfaces that rely heavily on AJAX requests. The severity rating of Medium by Chromium security reflects the dependency on an initial compromise, but it underscores the importance of maintaining strict CORS enforcement even within sandboxed environments to prevent privilege escalation and lateral movement.
Mitigation for this vulnerability requires immediate action to update Google Chrome to version 153.0.8010.36 or later, where these authorization checks have been corrected. For organizations managing large fleets of devices, deploying automated patch management solutions is essential to ensure timely updates across all endpoints. Additionally, developers should review their web applications for any reliance on permissive CORS configurations that might exacerbate the impact of such browser-level flaws. Implementing Content Security Policy headers can provide an additional layer of defense by restricting the sources from which content can be loaded and executed. Regular security audits focusing on cross-origin request handling and strict adherence to OWASP guidelines for preventing Cross-Origin Resource Sharing attacks will further reduce the risk surface. Users should also maintain up-to-date antivirus and endpoint detection solutions that monitor for suspicious network activity indicative of data exfiltration attempts, although these are secondary controls compared to patching the underlying browser vulnerability.