CVE-2026-87571

The vulnerability arises from improper certificate validation in the Loader component of Google Chrome. An attacker who can drive the browser to process crafted network traffic can cause the browser to accept an invalid certificate. This leads to the browser treating traffic from an untrusted issuer as trusted and bypassing the web origin policy. The bypass enables a malicious site to read or write data malicious content. The CVE lists the severity as low, but the impact on confidentiality and integrity can be significant depending on the context.

Google Chrome is affected. The issue exists in all versions prior to 153.0.8010.36. No specific patch version was supplied, but updating to 153.0.8010.36 or later resolves the issue.

The EPSS score of <1% and a CVSS score of 5.4, with no listing in CISA KEV, suggest a low probability of exploitation. The lack of a public exploit suggests that exploitation is likely low‑probability and requires an attack that can deliver malicious network traffic to a victim’s browser. Because the vulnerability is triggered by crafted network traffic and involves certificate handling, the attack vector is inferred to be network‑bound, possibly via phishing or a malicious website that encourages users to visit a specially crafted URL. Without a public exploit, the risk remains low, but the potential for origin‑policy bypass warrants patching.