CVE-2026-87622

A flaw was found in chromium-browser. Missing authorization in the Federated Credential Management FedCM API allowed a remote attacker to bypass the web origin policy. This bypass could be achieved by enticing a user to visit a crafted HTML page, potentially leading to unauthorized access to...

CVE-2026-87449

A flaw was found in Google Chrome. This cross-site request forgery CSRF vulnerability, which tricks a web browser into executing an unwanted action on a trusted site where the user is authenticated, specifically affects the DeviceBoundSessionCredentials feature. A remote attacker can exploit this...

CVE-2026-87466

A flaw was found in Chromium. Incorrect authorization within the Workers component allows a remote attacker to bypass the web origin policy. This can be achieved by enticing a user to visit a specially crafted HTML page, potentially leading to unauthorized access to sensitive information or actio...

CVE-2026-87561

A flaw was found in chromium-browser. A remote attacker could exploit incorrect authorization in Web Authentication by using a specially crafted Chrome extension. This could allow the attacker to bypass the web origin policy, potentially leading to unauthorized access or information disclosure...

CVE-2026-87614

A flaw was found in ServiceWorker in Google Chrome. This vulnerability, stemming from incorrect authorization, could allow a remote attacker who has already compromised the browser's rendering engine to bypass the web origin policy. Bypassing this policy could enable unauthorized access to data o...

CVE-2026-87508

A flaw was found in the Loader component of Google Chrome. This incorrect authorization vulnerability allows a remote attacker to bypass the web origin policy by enticing a user to visit a specially crafted HTML page. This could lead to unauthorized access to sensitive information or actions acro...

CVE-2026-87652

A flaw was found in Google Chrome's PushAPI. A remote attacker, after compromising the renderer process, could exploit an incorrect authorization vulnerability by crafting a malicious HTML page. This could allow the attacker to bypass the web origin policy, potentially leading to unauthorized...

CVE-2026-87573

A flaw was found in Google Chrome. Improper input validation within the Network component allows a remote attacker to bypass the web origin policy. This vulnerability can be exploited by enticing a user to visit a specially crafted HTML page. A successful exploit could lead to unauthorized access...

CVE-2026-87608

CVE-2026-87608 is an improper certificate validation flaw in FedCM (Federated Credentials) in Google Chrome prior to 153.0.8010.36 . A remote attacker leveraging social engineering can use crafted network traffic to bypass web origin policy , rated Low severity by Chromium. The fix is included in...

CVE-2026-87551

CVE-2026-87551 addresses an improper certificate validation flaw in the CORS (Cross-Origin Resource Sharing) implementation of Google Chrome prior to 153.0.8010.36 . A remote attacker leveraging social engineering could use crafted network traffic to bypass the web origin policy , potentially acc...

CVE-2026-87469

CVE-2026-87469 is an improper input validation vulnerability in the Extensions component of Google Chrome prior to version 153.0.8010.36 . A remote attacker can leverage crafted network traffic to bypass web origin policy and gain access to a privileged page. Chromium classifies the severity as L...

CVE-2026-87598

CVE-2026-87598 affects Google Chrome prior to 153.0.8010.36 , where an incorrect authorization in the ServiceWorker component allows a remote attacker to bypass the web origin policy by serving a crafted HTML page. The Chromium project rates the security severity as Low . The fix is available in ...

CVE-2026-87561

Incorrect authorization in the Web Authentication component of Google Chrome prior to version 153.0.8010.36 allowed a remote attacker to bypass the web origin policy via a crafted Chrome extension. The Chromium security team rated this vulnerability as Low severity. The fix was delivered in Chrom...

CVE-2026-87614

CVE-2026-87614 is an incorrect authorization vulnerability in ServiceWorker in Google Chrome prior to version 153.0.8010.36 . A remote attacker who had already compromised the renderer process could bypass the web origin policy using a crafted HTML page. Chromium rates this with a Low security se...

CVE-2026-87632

CVE-2026-87632 is a cross-site scripting (XSS) vulnerability in the SanitizerAPI component of Google Chrome prior to 153.0.8010.36 . A remote attacker can exploit it via a crafted HTML page to bypass the web origin policy , as classified by Chromium with a Medium security severity. The fix is ava...

CVE-2026-87550

Google Chrome prior to 153.0.8010.36 is affected by a vulnerability in CSS output encoding/escaping . A remote attacker can potentially bypass the web origin policy by delivering a crafted HTML page that exploits improper handling of CSS output. Chromium rates the security severity as Medium . Th...

CVE-2026-87573

CVE-2026-87573 is an improper input validation vulnerability in the Network component of Google Chrome prior to version 153.0.8010.36 . It allows a remote attacker to bypass the web origin policy by serving a crafted HTML page, rated Medium severity by the Chromium team. The fix is available in C...

CVE-2026-87508

CVE-2026-87508 is an incorrect authorization flaw in the Loader component of Google Chrome prior to version 153.0.8010.36 . A remote attacker could exploit this by serving a crafted HTML page to bypass the web origin policy , potentially allowing cross-origin access to otherwise protected resourc...

CVE-2026-87466

CVE-2026-87466 is an incorrect authorization flaw in the Workers component of Google Chrome prior to version 153.0.8010.36 . A remote attacker can bypass the web origin policy by serving a crafted HTML page to a victim. The Chromium project rates the security severity as Medium . The fix is to up...

CVE-2026-87652

An incorrect authorization flaw in the PushAPI component of Google Chrome prior to version 153.0.8010.36 allowed a remote attacker who had already compromised the renderer process to bypass the web origin policy via a crafted HTML page. The Chromium security team rated this vulnerability as Mediu...