CVE-2026-87651 in Chrome
Summary
by MITRE • 09/09/2026
Incorrect authorization in Paint in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as an incorrect authorization flaw within the paint subsystem of Google Chrome, specifically in versions prior to 153.0.8010.36, represents a significant breach in browser isolation mechanisms. This issue stems from improper access control checks during the rendering and compositing phases where graphical operations are executed. In modern web browsers, the same-origin policy is critical for preventing malicious websites from accessing sensitive data belonging to other origins. However, when authorization logic fails within internal components like paint handling, it can allow a remote attacker to bypass these restrictions by crafting specific HTML pages that exploit race conditions or state management errors in how graphical resources are shared across different contexts.
From a technical perspective, this flaw likely involves the improper validation of origin headers or context identifiers during canvas operations or image processing tasks handled by the browser's graphics pipeline. When an attacker constructs a malicious webpage containing carefully crafted scripts and HTML elements, they can trigger code paths that interact with cross-origin resources without proper permission verification. This allows the extraction of data such as images, text content, or other sensitive information from tabs or windows belonging to different origins. The severity is classified as high because it directly undermines one of the core security pillars of web browsers: isolation between browsing contexts.
The operational impact of this vulnerability enables cross-origin data theft through remote exploitation. An attacker does not need physical access or user interaction beyond visiting a malicious site, which can be delivered via phishing links or drive-by downloads. Once exploited, the attacker gains unauthorized read access to private information from other websites visited by the same browser instance. This could include personal details, financial information, session tokens, or proprietary data hosted on third-party sites. Such breaches compromise user privacy and trust in the browsing environment while potentially facilitating further attacks like account takeover if sensitive credentials are exposed through side-channel leaks facilitated by this initial access.
To mitigate risks associated with this vulnerability, users must immediately update Google Chrome to version 153.0.8010.36 or later where these authorization checks have been corrected and hardened against exploitation attempts. Organizations should enforce automated patch management policies to ensure all endpoints running affected versions are updated promptly. Additionally, implementing strict Content Security Policies can help limit the impact of potential future exploits by restricting script execution origins and resource loading behaviors. Monitoring browser logs for unusual cross-origin requests may also aid in detecting attempted exploitation activities before significant damage occurs.
This incident aligns with Common Weakness Enumeration category CWE-269 which addresses improper authorization, highlighting failures in enforcing access control policies within software systems. It also relates to MITRE ATT&CK technique T1059 known as Command and Scripting Interpreter abuse when considering how attackers leverage browser capabilities for data exfiltration. Understanding these mappings helps security teams prioritize remediation efforts based on standardized frameworks that reflect real-world threat behaviors and systemic weaknesses in application design rather than isolated code defects alone.