CVE-2026-87551

Modified Modified - Updated After Analysis

Improper Certificate Validation in Google Chrome

Publication date: 2026-09-09

Last updated on: 2026-09-14

Assigner: Chrome

Description

Improper certificate validation in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. (Chromium security severity: Low)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-14

Generated

2026-09-29

AI Q&A

2026-09-09

EPSS Evaluated

2026-09-27

NVD

CVE-2026-87551

EUVD

EUVD-2026-74473

Affected Vendors & Products

Vendor	Product	Version / Range
google	chrome	to 153.0.8010.36 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-295	The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

Executive Summary

This vulnerability involves improper certificate validation in CORS within Google Chrome versions before 153.0.8010.36. It allows a remote attacker to bypass web origin policy through crafted network traffic, potentially tricking users into interacting with malicious sites via social engineering tactics.

Detection Guidance

This vulnerability involves improper certificate validation in CORS in Google Chrome. Detection would require checking Chrome version and monitoring for unusual network traffic patterns. Update Chrome to version 153.0.8010.36 or later to mitigate the issue.

Impact Analysis

An attacker could exploit this to access sensitive data or perform unauthorized actions on websites you visit by bypassing same-origin restrictions. This might lead to data theft, session hijacking, or phishing attacks if you are tricked into visiting a malicious site.

Compliance Impact

This vulnerability could lead to unauthorized data exposure or breaches, which may violate GDPR (data protection) or HIPAA (health data privacy) if exploited. Organizations using affected Chrome versions may face compliance risks due to potential data leaks.

Mitigation Strategies

Update Google Chrome to version 153.0.8010.36 or later to address the improper certificate validation in CORS.

Hi! I’m here to help you understand CVE-2026-87551. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70