CVE-2026-87622 in Chrome
Summary
by MITRE • 09/09/2026
Missing authorization in FedCM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as missing authorization within the Federated Identity Management system, known as FedCM, in Google Chrome prior to version 153.0.8010.36 represents a significant deviation from expected access control mechanisms. This flaw specifically impacts the browser's ability to enforce web origin policies during federated authentication flows. In standard operation, browsers rely on strict same-origin policies and authorization checks to ensure that sensitive identity data is only shared with trusted origins. The absence of proper authorization verification in this context allows a remote attacker to manipulate these protocols, effectively bypassing the security boundaries designed to isolate different web contexts. This type of failure falls under the category of improper access control vulnerabilities, which are frequently categorized within Common Weakness Enumeration standards as CWE-284 Improper Access Control or potentially CWE-913 for improper control of frequency of limiting requests if the flaw involves race conditions in token issuance.
From a technical perspective, FedCM is designed to streamline user authentication by allowing websites to request identity information from an identity provider without handling passwords directly. The security model relies heavily on the browser acting as a trusted mediator that validates the requesting origin against authorized lists and ensures that tokens are issued only when explicit consent and authorization criteria are met. In this specific instance, the implementation failed to adequately verify whether the initiating page had legitimate authority to request or receive identity assertions from the provider. Consequently, an attacker could craft a malicious HTML page that exploits this gap in logic. By leveraging standard web technologies such as JavaScript and iframe injections, the crafted page can trigger authentication requests that appear valid to the browser's internal state machine but lack the necessary authorization tokens or permissions required by the security policy. This allows the attacker to intercept or receive identity data intended for a different origin, thereby violating the isolation guarantees provided by the same-origin policy.
The operational impact of this vulnerability is primarily centered on privacy violations and potential account takeover scenarios if combined with other attack vectors. By bypassing web origin policies, an attacker can potentially access sensitive user profile information such as email addresses or unique identifiers associated with a logged-in session. This data leakage undermines the confidentiality guarantees expected by users who rely on single sign-on services for secure authentication. Furthermore, in environments where identity tokens are used to establish sessions across multiple domains, obtaining unauthorized tokens could allow an attacker to impersonate legitimate users within specific application contexts. While the Chromium security severity is rated as medium, indicating that exploitation requires user interaction or a crafted page rather than fully automated remote code execution, the implications for data integrity and confidentiality remain substantial. The vulnerability aligns with ATT&CK techniques related to browser-based attacks, specifically those involving credential harvesting or unauthorized access through misconfigured web applications.
Mitigation strategies focus primarily on applying the vendor-provided software updates that address the authorization logic flaws within the FedCM implementation. Administrators should ensure that all instances of Google Chrome are updated to version 153.0.8010.36 or later, where these checks have been reinforced. For organizations deploying managed browsers, enforcing update policies through endpoint management solutions is critical to prevent exposure in enterprise environments. Additionally, developers integrating FedCM into their applications should review their implementation for any reliance on implicit trust assumptions and ensure that they are correctly handling the authorization responses returned by the browser. Security monitoring tools can be configured to detect anomalous patterns of identity token requests originating from untrusted or unexpected origins, providing an additional layer of defense against exploitation attempts while patching efforts proceed.