Description
Missing authorization in FedCM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
Published: 2026-09-09
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized bypass of web origin policy via FedCM
Action: Apply patch
AI Analysis

Impact

The vulnerability is a missing authorization check in the FedCM module of Google Chrome which allows a remote attacker to serve a crafted HTML page that bypasses the browser’s web origin policy. This flaw can enable an attacker to read or manipulate data that is normally protected by the same‑origin policy.

Affected Systems

Google Chrome browsers prior to version 153.0.8010.36 on all supported platforms are affected.

Risk and Exploitability

Chromium lists the issue with a CVSS score of 4.3 (Medium). The EPSS score is less than 1% and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote attack via a crafted HTML page loaded into Chrome; no elevated privileges or local access are required.

Generated by OpenCVE AI on September 9, 2026 at 20:15 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Google Chrome to version 153.0.8010.36 or later.
  • If an upgrade cannot be performed immediately, use Chrome enterprise policies to disable the FedCM API until a patch is available.
  • Continuously monitor audit logs and browser telemetry for suspicious use of the FedCM functionality.

Generated by OpenCVE AI on September 9, 2026 at 20:15 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4790-1 chromium security update
Debian DSA Debian DSA DSA-6506-1 chromium security update
History

Wed, 09 Sep 2026 20:45:00 +0000

Type Values Removed Values Added
Title Missing Authorization in FedCM Allows Web Origin Policy Bypass

Wed, 09 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
Vendors & Products Google
Google chrome

Wed, 09 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 09 Sep 2026 07:30:00 +0000

Type Values Removed Values Added
Title Missing Authorization in FedCM Allows Web Origin Policy Bypass

Wed, 09 Sep 2026 01:00:00 +0000

Type Values Removed Values Added
Description Missing authorization in FedCM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-862
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-09-09T17:25:54.752Z

Reserved: 2026-09-08T22:42:59.842Z

Link: CVE-2026-87622

cve-icon Vulnrichment

Updated: 2026-09-09T17:25:09.278Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-09T01:17:20.440

Modified: 2026-09-09T20:21:41.940

Link: CVE-2026-87622

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-10T14:15:07Z

Weaknesses