CVE-2026-87563 Overview
CVE-2026-87563 is an origin validation error [CWE-346] in the Paint component of Google Chrome. The flaw affects Chrome versions prior to 153.0.8010.36. A remote attacker can obtain cross-origin data by convincing a user to load a crafted HTML page. Chromium classifies the security severity as Medium.
The vulnerability breaks the same-origin policy that isolates content between web origins. Successful exploitation exposes data that should remain confidential to the originating site. User interaction is required, and no authentication is needed.
Critical Impact
Remote attackers can read cross-origin data from a victim's browser session by serving a crafted HTML page, bypassing same-origin protections in the Paint component.
Affected Products
- Google Chrome versions prior to 153.0.8010.36
- Chromium-based browsers using the vulnerable Paint component
- Desktop Chrome Stable channel builds released before the September 2026 update
Discovery Timeline
- 2026-09-09 - CVE-2026-87563 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-87563
Vulnerability Analysis
The issue resides in Chrome's Paint component, which handles rendering operations for web content. An origin validation error allows content from one origin to access rendering data associated with another origin. This category of flaw ([CWE-346]) occurs when the browser fails to verify that the requesting context matches the origin of the resource being processed.
The attack requires user interaction, typically by visiting an attacker-controlled page. Confidentiality is affected while integrity and availability remain intact. The scope is unchanged, meaning the impact is confined to the browser's security boundary rather than the underlying host.
Root Cause
The root cause is improper origin validation within the Paint rendering path. When the component processes graphical content, it does not consistently enforce the same-origin policy on cross-origin resources. This gap allows a malicious page to observe pixel or paint-derived data that belongs to another origin loaded in the same browser context.
Attack Vector
Exploitation follows a network-based vector with low attack complexity. The attacker hosts a crafted HTML page and lures the target to visit it, for example through phishing or a compromised advertisement. Once loaded, the page triggers the Paint code path in a way that exposes cross-origin rendering data.
No verified proof-of-concept has been published. See the Chromium Issue Tracker #532952073 and the Google Chrome Stable Channel Update for vendor details.
Detection Methods for CVE-2026-87563
Indicators of Compromise
- Browser client versions of Google Chrome earlier than 153.0.8010.36 observed on managed endpoints.
- Outbound connections from user browsers to newly registered or low-reputation domains hosting suspicious HTML content.
- Anomalous cross-origin resource loads and canvas or image element usage from untrusted pages during the same browser session as sensitive web applications.
Detection Strategies
- Inventory Chrome versions across the fleet and flag any installation below 153.0.8010.36 as vulnerable.
- Correlate web proxy logs with threat intelligence feeds to identify user visits to pages known to host cross-origin data theft techniques.
- Alert on browser telemetry events indicating unusual paint or canvas API activity paired with cross-origin requests.
Monitoring Recommendations
- Enforce browser version reporting through endpoint management and dashboard the count of out-of-date Chrome installs.
- Monitor DNS and HTTP telemetry for user access to attacker-controlled infrastructure that could serve crafted HTML.
- Track authentication anomalies on high-value web applications that could indicate session data leakage following browser-based attacks.
How to Mitigate CVE-2026-87563
Immediate Actions Required
- Update Google Chrome to version 153.0.8010.36 or later on all endpoints.
- Push the update through enterprise management tooling and verify version compliance across managed devices.
- Restart Chrome after the update to ensure the patched binaries are loaded into running processes.
Patch Information
Google addressed CVE-2026-87563 in the Chrome Stable channel release documented in the Google Chrome Stable Channel Update. Upgrade to 153.0.8010.36 or later. Chromium-based browsers that embed the affected Paint code should apply the corresponding upstream fix referenced in Chromium Issue Tracker #532952073.
Workarounds
- Restrict browsing to trusted sites through enterprise URL allowlists until patching is complete.
- Deploy web filtering to block access to newly observed or low-reputation domains that could host the crafted HTML payload.
- Educate users to avoid clicking untrusted links, since exploitation requires user interaction with the malicious page.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.