CVE-2026-87453
Description
A flaw was found in chromium-browser's BackgroundFetch component. A remote attacker, who has already compromised the renderer process, could exploit a confused deputy vulnerability by using a specially crafted HTML page. This could lead to the disclosure of sensitive information.
Statement
This vulnerability is evaluated as having an Important severity impact because an attacker with compromised control over an untrusted renderer sandbox can bypass internal privilege separations to access restricted cross-origin data. In standard Red Hat Enterprise Linux deployments, Chromium is not shipped as a supported core package, restricting enterprise footprint primarily to community repositories such as EPEL. Although exploitation demands a prior compromise of the browser rendering environment, the resultant scope breach elevates the risk by facilitating unauthorized data exfiltration across web origins.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Gain Privileges or Assume Identity
A user can access restricted functionality and/or sensitive information that may include administrative functionality and user accounts.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
