Live › vulnerability › CVE-2026-87897
Go to dashboardA server-side request forgery flaw lets a low-privileged user reach internal Chrome DevTools Protocol APIs. An attacker can capture another user's JWT authentication token when that user starts a recording, then read and write that user's Whiteboard.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 17:32 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A SSRF vulnerability found that enables access to internal Chrome Devtools Protocol APIs that can leak the JWT authentication token for another user. A low privileged attacker could continually exploit this vulnerability to leak the JWT authentication token for another user when they start a recording, which then enables the attacker read/write access to the victim's Whiteboard.
This page as .md · .json · in your agent: get_signal("CVE-2026-87897")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.