CVE-2026-87485 in Chrome
Summary
by MITRE • 09/09/2026
Incorrect authorization in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as an incorrect authorization issue within the Cross-Origin Resource Sharing mechanism in Google Chrome prior to version 153.0.8010.36 represents a significant deviation from expected browser security boundaries. This flaw specifically impacts the enforcement of web origin policies, which are fundamental mechanisms designed to isolate content loaded from different origins to prevent malicious scripts on one site from accessing data on another. The severity is classified as medium by Chromium standards, indicating that while the vulnerability allows for policy bypasses, it requires specific preconditions regarding process isolation and attacker access levels rather than being a trivial remote code execution vector.
The technical root cause lies in how the browser handles authorization checks during CORS requests when originating from compromised renderer processes. In modern browsers like Chrome, each tab or frame typically runs in its own sandboxed renderer process to limit the blast radius of any potential exploit. However, if an attacker has already managed to compromise a renderer process through another vulnerability or social engineering tactic, they gain the ability to execute arbitrary JavaScript within that isolated context. The flaw allows this compromised renderer to craft HTML pages and HTTP requests that trick the browser into incorrectly authorizing cross-origin resource sharing operations. Essentially, the browser fails to properly validate whether the requesting origin is permitted to access specific resources when the request originates from a process that has been subverted, leading to an unauthorized elevation of privileges within the web context.
From an operational impact perspective, this vulnerability enables a remote attacker who possesses renderer-level compromise to bypass strict same-origin policies. This bypass can lead to data exfiltration where sensitive information such as cookies, local storage contents, or API responses intended for legitimate users are accessed by malicious scripts. It also facilitates cross-site request forgery attacks and allows the reading of resources from internal networks if those resources are accessible via HTTP without additional authentication layers that might have been bypassed due to the CORS misconfiguration. The ability to read data across origins undermines the confidentiality guarantees provided by modern web security models, potentially leading to account takeover or sensitive data leakage depending on the target environment and the specific applications being accessed.
This vulnerability aligns with CWE-269, which describes Improper Privilege Assignment, as it involves a failure in correctly assigning permissions for cross-origin access based on the source of the request. Furthermore, from an offensive security perspective mapped to MITRE ATT&CK techniques, this behavior is consistent with T1530 Data from Local System Exfiltration and potentially T1078 Valid Accounts if combined with credential theft, as it allows unauthorized data retrieval that would normally be blocked by browser sandboxing rules. The exploitation path relies heavily on the initial compromise of a renderer process, meaning mitigations often focus on hardening against those initial entry points while also ensuring robust enforcement of CORS policies regardless of the calling context's integrity status.
To mitigate this risk and similar issues in web browsers, it is essential to ensure that all systems are updated to Google Chrome version 153.0.8010.36 or later where these authorization checks have been corrected. Organizations should implement strict Content Security Policy headers to limit the sources from which scripts can be loaded and executed, thereby reducing the attack surface for renderer compromises. Additionally, developers should avoid relying solely on CORS for security decisions in sensitive applications and instead enforce server-side validation of all cross-origin requests. Regular patching cycles and monitoring for browser updates are critical components of a defense-in-depth strategy to protect against vulnerabilities that exploit complex interactions between browser processes and web standards.