CVE-2026-87531 in Chrome
Summary
by MITRE • 09/09/2026
Information leak in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability described involves a flaw in the Cross-Origin Resource Sharing implementation within Google Chrome prior to version 153.0.8010.36, classified with a medium security severity by Chromium. This issue stems from an improper enforcement of cross-origin policies that allows for information leakage when specific conditions are met. The core technical flaw lies in how the browser handles CORS headers and preflight requests during navigation or resource fetching operations initiated by compromised renderer processes. When a renderer process is already compromised, it typically has limited privileges but can still execute JavaScript within its sandboxed environment. In this scenario, the vulnerability allows such a maliciously crafted HTML page to bypass expected isolation boundaries, enabling the extraction of data from other origins that should remain inaccessible under standard security models.
From an operational perspective, this flaw represents a significant risk in environments where users may visit untrusted websites or when browser extensions with elevated privileges are present and potentially vulnerable themselves. An attacker who has achieved code execution within a renderer process can leverage this CORS misconfiguration to exfiltrate sensitive information such as session tokens, personal data, or internal application states from other tabs or origins that the user is currently interacting with. This effectively undermines the same-origin policy which serves as the foundational security model for web browsers, allowing lateral movement and privilege escalation within the browser context without requiring further exploitation steps like sandbox escapes.
The attack vector aligns closely with CWE-200, which defines an information exposure vulnerability where sensitive data is made available to unauthorized actors. Furthermore, this behavior maps to MITRE ATT&CK techniques related to Collection from Browser or Exfiltration Over Alternative Protocol if the stolen data is sent out via non-standard channels. The ability of a renderer process to leak cross-origin data highlights gaps in the strict separation between different origin contexts and underscores the importance of robust CORS validation logic that prevents even partially compromised processes from leveraging browser features for unauthorized access.
Mitigation strategies primarily involve updating Google Chrome to version 153.0.8010.36 or later, where these specific CORS enforcement mechanisms have been corrected. For organizations managing large fleets of endpoints, ensuring automatic update policies are in place is critical to prevent exposure during the window between vulnerability disclosure and patch deployment. Additionally, implementing strict Content Security Policy headers can help restrict how resources are loaded and reduce the attack surface for renderer-based exploits. Users should also be advised against visiting untrusted sites while logged into sensitive applications and consider using browser isolation technologies or sandboxed environments for high-risk browsing activities to further mitigate the impact of potential renderer compromises.