CVE-2026-87551

View on CVE.org
Published Sep 9, 2026 CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Description
Improper certificate validation in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. (Chromium security severity: Low)

Analysis

AI-generated

Technical impact

The vulnerability in Google Chrome’s CORS implementation allows a remote attacker to craft network traffic that tricks the browser into trusting a certificate that does not belong to the intended origin, thereby bypassing the web origin policy. This flaw is an example of improper authentication or validation (CWE-295) and can lead to unauthorized access or manipulation of data that should be confined to a trusted domain.

Affected Systems

Google Chrome versions prior to 153.0.8010.36 are affected. Any installation of Chrome that has not yet been updated to the fixed release is vulnerable.

Risk and Exploitability

The CVSS score of 4.3 and an EPSS score of less than 1% indicate a low intrinsic severity and a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, exploitation requires a social‑engineering component, such as persuading a user to visit a maliciously crafted site that employs a forged certificate. If successful, the attacker could compromise the confidentiality or integrity of cross‑origin resources but would not gain arbitrary system control. The overall risk is moderate, pending ongoing monitoring for attack activity.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Google Chrome to version 153.0.8010.36 or later where the certificate validation issue is fixed.
  • If an upgrade is not immediately feasible, enforce a restrictive Content Security Policy that limits cross‑origin requests to trusted origins and apply network‑level filtering to block forged certificate traffic.
  • Provide user awareness training to help staff recognize and avoid phishing or social–engineering attempts that may lead to reliance on untrusted certificates.

Generated by OpenCVE AI on September 10, 2026 at 15:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-4790-1 chromium security update
Debian DSA Debian DSA DSA-6506-1 chromium security update
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Title Improper Certificate Validation in CORS Allows Web Origin Policy Bypass
Type Values Removed Values Added
First Time appeared Google
Google chrome
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
Vendors & Products Google
Google chrome
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'}
Type Values Removed Values Added
Title Improper Certificate Validation in CORS Allows Web Origin Policy Bypass
Type Values Removed Values Added
Description Improper certificate validation in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. (Chromium security severity: Low)
Weaknesses CWE-295
References
Weaknesses
  • CWE-295

    Improper Certificate Validation

Sources

Status
PUBLISHED
Assigner
Chrome
Published
Updated
Sep 14, 2026, 12:51 PM
Reserved
Sep 8, 2026, 10:40 PM

View source JSON

Updated
Sep 14, 2026, 12:51 PM

JSON

Status
Modified
Published
Sep 9, 2026, 1:17 AM
Modified
Sep 14, 2026, 1:18 PM

View source JSON

No data.

Updated
Sep 10, 2026, 11:45 PM

JSON