CVE-2026-87652

A flaw was found in Google Chrome's PushAPI. A remote attacker, after compromising the renderer process, could exploit an incorrect authorization vulnerability by crafting a malicious HTML page. This could allow the attacker to bypass the web origin policy, potentially leading to unauthorized...

CVE-2026-87652

An incorrect authorization flaw in the PushAPI component of Google Chrome prior to version 153.0.8010.36 allowed a remote attacker who had already compromised the renderer process to bypass the web origin policy via a crafted HTML page. The Chromium security team rated this vulnerability as Mediu...

PT-2026-88752

Incorrect authorization in PushAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...