CVE-2026-87563
Origin validation error in Paint in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Scoring
- Severity
- MEDIUM
- CVSS base score
- 4.3
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
- EPSS probability
- 0.14%
- CWE
- CWE-346
- Published
- 2026-09-09
- Last modified
- 2026-09-09
Affected products
- Google Chrome
Weakness type
Related vulnerabilities
- CVE-2026-58649 — .NET Information Disclosure Vulnerability
- CVE-2026-69559 — Microsoft Teams for Android Information Disclosure Vulnerability
- CVE-2026-69680 — Windows DNS Spoofing Vulnerability
- CVE-2026-75156 — Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
- CVE-2026-85152 — undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors
- CVE-2026-84482 — WWBN AVideo Cross-Site Request Forgery via get_domain() validation
- CVE-2026-82811 — Toggl OÜ Toggl Track Extension postMessage origin validation
- CVE-2026-81315 — MCP DNS-rebinding origin check in AshAi is bypassed by a spoofed X-Forwarded-Proto header