{"id":"CVE-2026-87563","title":"Origin validation error in Paint in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafted HTML page","summary":"Origin validation error in Paint in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","cwe":["CWE-346"],"vendor":"google","product":"chrome","affected":["chrome < 153.0.8010.36"],"patched":["chrome 153.0.8010.36"],"published":"2026-09-09","updated":"2026-09-09","sourceUpdated":"2026-09-09T19:18:37.500","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87563","references":[{"url":"https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html","label":"chrome-cve-admin@google.com"},{"url":"https://issues.chromium.org/issues/532952073","label":"chrome-cve-admin@google.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-87563.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-87563"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-87563"}],"tags":["nvd","cve.org","csaf","vex","red-hat","score-dispute"],"epss":0.00164,"epssPercentile":0.06012,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-09T15:08:44.479666Z"},"scores":{"nvd":4.3,"adp":4.3,"vendor":6.5},"ingestedAt":"2026-09-09T01:17:17.507Z","slug":"CVE-2026-87563","body":"## Overview\n\nOrigin validation error in Paint in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)\n\n## Affected\n\n- `chrome < 153.0.8010.36`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `chrome 153.0.8010.36`\n\n## Vendor advisories\n\n- **Red Hat VEX** · updated 2026-09-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-87563.json)","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":202436,"id":"CVE-2026-87563","ts":1789400074639,"field":"cvss","old":null,"new":"4.3"},{"seq":202435,"id":"CVE-2026-87563","ts":1789400074639,"field":"severity","old":"none","new":"medium"},{"seq":201163,"id":"CVE-2026-87563","ts":1789397620143,"field":"cvss","old":"4.3","new":null},{"seq":201162,"id":"CVE-2026-87563","ts":1789397620143,"field":"severity","old":"medium","new":"none"},{"seq":199856,"id":"CVE-2026-87563","ts":1789395578106,"field":"cvss","old":null,"new":"4.3"},{"seq":199855,"id":"CVE-2026-87563","ts":1789395578106,"field":"severity","old":"none","new":"medium"},{"seq":199097,"id":"CVE-2026-87563","ts":1789392260223,"field":"cvss","old":"4.3","new":null},{"seq":199096,"id":"CVE-2026-87563","ts":1789392260223,"field":"severity","old":"medium","new":"none"},{"seq":197430,"id":"CVE-2026-87563","ts":1789384296769,"field":"cvss","old":null,"new":"4.3"},{"seq":197429,"id":"CVE-2026-87563","ts":1789384296769,"field":"severity","old":"none","new":"medium"},{"seq":196704,"id":"CVE-2026-87563","ts":1789383771393,"field":"cvss","old":"4.3","new":null},{"seq":196703,"id":"CVE-2026-87563","ts":1789383771393,"field":"severity","old":"medium","new":"none"},{"seq":195608,"id":"CVE-2026-87563","ts":1789380578141,"field":"cvss","old":null,"new":"4.3"},{"seq":195607,"id":"CVE-2026-87563","ts":1789380578141,"field":"severity","old":"none","new":"medium"},{"seq":194559,"id":"CVE-2026-87563","ts":1789378789372,"field":"cvss","old":"4.3","new":null},{"seq":194558,"id":"CVE-2026-87563","ts":1789378789372,"field":"severity","old":"medium","new":"none"},{"seq":193346,"id":"CVE-2026-87563","ts":1789376520790,"field":"cvss","old":null,"new":"4.3"},{"seq":193345,"id":"CVE-2026-87563","ts":1789376520790,"field":"severity","old":"none","new":"medium"},{"seq":192133,"id":"CVE-2026-87563","ts":1789373639175,"field":"cvss","old":"4.3","new":null},{"seq":192132,"id":"CVE-2026-87563","ts":1789373639175,"field":"severity","old":"medium","new":"none"},{"seq":190918,"id":"CVE-2026-87563","ts":1789369487706,"field":"cvss","old":null,"new":"4.3"},{"seq":190917,"id":"CVE-2026-87563","ts":1789369487706,"field":"severity","old":"none","new":"medium"},{"seq":189705,"id":"CVE-2026-87563","ts":1789368460754,"field":"cvss","old":"4.3","new":null},{"seq":189704,"id":"CVE-2026-87563","ts":1789368460754,"field":"severity","old":"medium","new":"none"},{"seq":188488,"id":"CVE-2026-87563","ts":1789365236718,"field":"cvss","old":null,"new":"4.3"},{"seq":188487,"id":"CVE-2026-87563","ts":1789365236718,"field":"severity","old":"none","new":"medium"},{"seq":187275,"id":"CVE-2026-87563","ts":1789363480091,"field":"cvss","old":"4.3","new":null},{"seq":187274,"id":"CVE-2026-87563","ts":1789363480091,"field":"severity","old":"medium","new":"none"},{"seq":186061,"id":"CVE-2026-87563","ts":1789361235365,"field":"cvss","old":null,"new":"4.3"},{"seq":186060,"id":"CVE-2026-87563","ts":1789361235365,"field":"severity","old":"none","new":"medium"},{"seq":184848,"id":"CVE-2026-87563","ts":1789358377106,"field":"cvss","old":"4.3","new":null},{"seq":184847,"id":"CVE-2026-87563","ts":1789358377106,"field":"severity","old":"medium","new":"none"},{"seq":183097,"id":"CVE-2026-87563","ts":1789354323218,"field":"cvss","old":null,"new":"4.3"},{"seq":183096,"id":"CVE-2026-87563","ts":1789354323218,"field":"severity","old":"none","new":"medium"},{"seq":181890,"id":"CVE-2026-87563","ts":1789353335070,"field":"cvss","old":"4.3","new":null},{"seq":181889,"id":"CVE-2026-87563","ts":1789353335070,"field":"severity","old":"medium","new":"none"},{"seq":180683,"id":"CVE-2026-87563","ts":1789350290712,"field":"cvss","old":null,"new":"4.3"},{"seq":180682,"id":"CVE-2026-87563","ts":1789350290712,"field":"severity","old":"none","new":"medium"},{"seq":179476,"id":"CVE-2026-87563","ts":1789348308369,"field":"cvss","old":"4.3","new":null},{"seq":179475,"id":"CVE-2026-87563","ts":1789348308369,"field":"severity","old":"medium","new":"none"},{"seq":178269,"id":"CVE-2026-87563","ts":1789346377711,"field":"cvss","old":null,"new":"4.3"},{"seq":178268,"id":"CVE-2026-87563","ts":1789346377711,"field":"severity","old":"none","new":"medium"},{"seq":177062,"id":"CVE-2026-87563","ts":1789343188310,"field":"cvss","old":"4.3","new":null},{"seq":177061,"id":"CVE-2026-87563","ts":1789343188310,"field":"severity","old":"medium","new":"none"},{"seq":175179,"id":"CVE-2026-87563","ts":1789334884363,"field":"cvss","old":null,"new":"4.3"},{"seq":175178,"id":"CVE-2026-87563","ts":1789334884363,"field":"severity","old":"none","new":"medium"},{"seq":173974,"id":"CVE-2026-87563","ts":1789333703487,"field":"cvss","old":"4.3","new":null},{"seq":173973,"id":"CVE-2026-87563","ts":1789333703487,"field":"severity","old":"medium","new":"none"},{"seq":172788,"id":"CVE-2026-87563","ts":1789331096720,"field":"cvss","old":null,"new":"4.3"},{"seq":172787,"id":"CVE-2026-87563","ts":1789331096720,"field":"severity","old":"none","new":"medium"}]}