Loading vulnerability…
Cross-origin data disclosure in Google Chrome Paint
CVE-2026-87651 is an incorrect authorization vulnerability in the Paint component of Google Chrome before version 153.0.8010.36. A remote attacker can use a crafted HTML page to obtain cross-origin data, bypassing browser restrictions on access between origins. Chromium classifies the vulnerability as High severity. The specific vulnerable function and implementation details are not available.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can disclose cross-origin information, with a high confidentiality impact. The CVSS v3.0 assessment identifies no direct integrity or availability impact. Code execution and privilege escalation are not established consequences of this vulnerability.
If you can’t patch tonight, do this now.
Until patched, restrict use of affected browsers and reduce exposure to untrusted or attacker-controlled web content through web-content filtering, restricted browsing, or browser isolation where available. No vulnerability-specific workaround is identified; these measures reduce exposure but do not correct the authorization flaw.
Patch, then assume compromise.
Update Google Chrome to version 153.0.8010.36 or later; macOS deployments should use 153.0.8010.37 or later. For Debian stable (trixie), update Chromium to 153.0.8010.47-2~deb13u1 or later. Prisma Browser version 153.3.3.37 includes the CVE-specific fix, while 155.16.5.40 or later addresses the complete October Chromium security update. For affected Microsoft Edge deployments, update to 153.0.4234.32 or later.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.