CVE-2026-87563: Google Chrome vulnerability

Q: What does an attacker need to exploit this issue?

An attacker needs to persuade a user to load a crafted HTML page in an affected Chrome version. The disclosed impact is obtaining cross-origin data.

Q: Which Chrome versions need to be updated?

Chrome versions prior to 153.0.8010.36 are affected. Update to 153.0.8010.36 or a later version.

Published Sep 9, 2026

Updated

Origin validation error in Paint in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

Affected Software

1 affected component

Google Chrome<153.0.8010.36

Event History

Sep 9, 2026

CVE Published

via MITRE·12:09 AM

Data Sourced

via MITRE·12:09 AM

DescriptionWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

An attacker needs to persuade a user to load a crafted HTML page in an affected Chrome version. The disclosed impact is obtaining cross-origin data.

Which Chrome versions need to be updated?

Chrome versions prior to 153.0.8010.36 are affected. Update to 153.0.8010.36 or a later version.