CVE-2026-87521 in Chrome
Summary
by MITRE • 09/09/2026
Information leak in WebMCP in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as an information leak within WebMCP in Google Chrome prior to version 153.0.8010.36 represents a significant breach of the browser's isolation model, specifically targeting the integrity of cross-origin data access controls. This flaw allows a remote attacker who has already achieved code execution or compromise within the renderer process to bypass security boundaries and extract sensitive information from other origins. The severity is classified as Medium by Chromium standards, reflecting that while it requires an initial foothold in the renderer, the potential for data exfiltration poses a serious risk to user privacy and application security. This type of vulnerability undermines the fundamental principle of same-origin policy, which is designed to prevent malicious scripts on one page from obtaining access to sensitive information on another page.
From a technical perspective, WebMCP likely refers to an internal component or API within Chrome's rendering engine that handles media processing contexts or similar operations. The flaw stems from improper validation or isolation mechanisms when handling data passed between different security domains. When a renderer process is compromised, typically through the exploitation of a separate vulnerability such as a use-after-free or buffer overflow in JavaScript execution, the attacker gains control over the thread executing web content. In this state, if WebMCP fails to properly enforce origin checks before exposing internal states or cached data, it creates a side-channel or direct access vector for retrieving cross-origin resources. This could include cookies, local storage contents, DOM elements from other sites, or sensitive API responses that were previously loaded into the context but not adequately sanitized for exposure during media processing operations.
The operational impact of this vulnerability is substantial because it facilitates data theft in scenarios where traditional phishing or drive-by download attacks have already succeeded at compromising a tab's renderer process. An attacker can leverage this flaw to build more sophisticated attack chains, moving from initial access to persistent surveillance or credential harvesting across multiple websites visited by the user within the same browser session. This is particularly dangerous for users who engage in sensitive activities such as online banking, healthcare portal usage, or corporate resource access on shared devices. The ability to exfiltrate cross-origin data effectively neutralizes many of the protections provided by modern web applications that rely on strict separation of context and origin-based security policies.
This vulnerability aligns with CWE-200, which categorizes information exposure as a class of weaknesses where sensitive information is disclosed without proper authorization or access controls. Furthermore, in terms of offensive cyber operations mapping, this behavior corresponds to the ATT&CK technique T1530, Data from Local System, specifically involving data staging and exfiltration over alternative protocols if combined with other tools. It also relates to T1078, Valid Accounts, by allowing an attacker to leverage compromised session tokens or credentials found in local storage across different domains. The lack of strict boundary enforcement between renderer processes and internal browser components highlights the complexity of maintaining security boundaries in large-scale software like Chrome, where performance optimizations sometimes introduce subtle logic errors that can be exploited for privilege escalation within the sandboxed environment.
Mitigation strategies primarily involve updating to Google Chrome version 153.0.8010.36 or later, which contains patches addressing these specific isolation failures in WebMCP. Organizations should ensure automated update policies are enforced across all endpoints to minimize exposure windows. For users unable to update immediately, disabling JavaScript execution for untrusted sites via browser extensions can reduce the attack surface by preventing the initial renderer compromise that leads to this information leak. Additionally, employing strict Content Security Policy headers on web applications can limit the impact if such an exploit is attempted, although it does not directly prevent low-level renderer exploits. Regular security audits and penetration testing focusing on cross-origin resource sharing configurations and browser sandbox integrity are recommended practices for enterprise environments relying heavily on Chrome-based infrastructure to maintain robust defense-in-depth postures against advanced persistent threats.