{"id":"CVE-2026-87550","title":"Improper encoding or escaping of output in CSS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page","summary":"Improper encoding or escaping of output in CSS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","cwe":["CWE-116"],"vendor":"google","product":"chrome","affected":["chrome < 153.0.8010.36"],"patched":["chrome 153.0.8010.36"],"published":"2026-09-09","updated":"2026-09-09","sourceUpdated":"2026-09-09T20:26:12.223","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87550","references":[{"url":"https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html","label":"chrome-cve-admin@google.com"},{"url":"https://issues.chromium.org/issues/518082852","label":"chrome-cve-admin@google.com"}],"tags":["nvd","cve.org"],"epss":0.00242,"epssPercentile":0.15695,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-09T17:25:07.445532Z"},"ingestedAt":"2026-09-09T01:17:17.508Z","slug":"CVE-2026-87550","body":"## Overview\n\nImproper encoding or escaping of output in CSS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)\n\n## Affected\n\n- `chrome < 153.0.8010.36`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `chrome 153.0.8010.36`","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":202410,"id":"CVE-2026-87550","ts":1789400072245,"field":"cvss","old":null,"new":"4.3"},{"seq":202409,"id":"CVE-2026-87550","ts":1789400072245,"field":"severity","old":"none","new":"medium"},{"seq":201137,"id":"CVE-2026-87550","ts":1789397620043,"field":"cvss","old":"4.3","new":null},{"seq":201136,"id":"CVE-2026-87550","ts":1789397620043,"field":"severity","old":"medium","new":"none"},{"seq":199830,"id":"CVE-2026-87550","ts":1789395578013,"field":"cvss","old":null,"new":"4.3"},{"seq":199829,"id":"CVE-2026-87550","ts":1789395578013,"field":"severity","old":"none","new":"medium"},{"seq":199071,"id":"CVE-2026-87550","ts":1789392260137,"field":"cvss","old":"4.3","new":null},{"seq":199070,"id":"CVE-2026-87550","ts":1789392260137,"field":"severity","old":"medium","new":"none"},{"seq":197404,"id":"CVE-2026-87550","ts":1789384296672,"field":"cvss","old":null,"new":"4.3"},{"seq":197403,"id":"CVE-2026-87550","ts":1789384296672,"field":"severity","old":"none","new":"medium"},{"seq":196678,"id":"CVE-2026-87550","ts":1789383769689,"field":"cvss","old":"4.3","new":null},{"seq":196677,"id":"CVE-2026-87550","ts":1789383769689,"field":"severity","old":"medium","new":"none"},{"seq":195582,"id":"CVE-2026-87550","ts":1789380578053,"field":"cvss","old":null,"new":"4.3"},{"seq":195581,"id":"CVE-2026-87550","ts":1789380578053,"field":"severity","old":"none","new":"medium"},{"seq":194533,"id":"CVE-2026-87550","ts":1789378789281,"field":"cvss","old":"4.3","new":null},{"seq":194532,"id":"CVE-2026-87550","ts":1789378789281,"field":"severity","old":"medium","new":"none"},{"seq":193320,"id":"CVE-2026-87550","ts":1789376520696,"field":"cvss","old":null,"new":"4.3"},{"seq":193319,"id":"CVE-2026-87550","ts":1789376520696,"field":"severity","old":"none","new":"medium"},{"seq":192107,"id":"CVE-2026-87550","ts":1789373639070,"field":"cvss","old":"4.3","new":null},{"seq":192106,"id":"CVE-2026-87550","ts":1789373639070,"field":"severity","old":"medium","new":"none"},{"seq":190892,"id":"CVE-2026-87550","ts":1789369487596,"field":"cvss","old":null,"new":"4.3"},{"seq":190891,"id":"CVE-2026-87550","ts":1789369487596,"field":"severity","old":"none","new":"medium"},{"seq":189679,"id":"CVE-2026-87550","ts":1789368460663,"field":"cvss","old":"4.3","new":null},{"seq":189678,"id":"CVE-2026-87550","ts":1789368460663,"field":"severity","old":"medium","new":"none"},{"seq":188462,"id":"CVE-2026-87550","ts":1789365236617,"field":"cvss","old":null,"new":"4.3"},{"seq":188461,"id":"CVE-2026-87550","ts":1789365236617,"field":"severity","old":"none","new":"medium"},{"seq":187249,"id":"CVE-2026-87550","ts":1789363480001,"field":"cvss","old":"4.3","new":null},{"seq":187248,"id":"CVE-2026-87550","ts":1789363480001,"field":"severity","old":"medium","new":"none"},{"seq":186035,"id":"CVE-2026-87550","ts":1789361235259,"field":"cvss","old":null,"new":"4.3"},{"seq":186034,"id":"CVE-2026-87550","ts":1789361235259,"field":"severity","old":"none","new":"medium"},{"seq":184822,"id":"CVE-2026-87550","ts":1789358376998,"field":"cvss","old":"4.3","new":null},{"seq":184821,"id":"CVE-2026-87550","ts":1789358376998,"field":"severity","old":"medium","new":"none"},{"seq":183071,"id":"CVE-2026-87550","ts":1789354323115,"field":"cvss","old":null,"new":"4.3"},{"seq":183070,"id":"CVE-2026-87550","ts":1789354323115,"field":"severity","old":"none","new":"medium"},{"seq":181864,"id":"CVE-2026-87550","ts":1789353334980,"field":"cvss","old":"4.3","new":null},{"seq":181863,"id":"CVE-2026-87550","ts":1789353334980,"field":"severity","old":"medium","new":"none"},{"seq":180657,"id":"CVE-2026-87550","ts":1789350290614,"field":"cvss","old":null,"new":"4.3"},{"seq":180656,"id":"CVE-2026-87550","ts":1789350290614,"field":"severity","old":"none","new":"medium"},{"seq":179450,"id":"CVE-2026-87550","ts":1789348308269,"field":"cvss","old":"4.3","new":null},{"seq":179449,"id":"CVE-2026-87550","ts":1789348308269,"field":"severity","old":"medium","new":"none"},{"seq":178243,"id":"CVE-2026-87550","ts":1789346377624,"field":"cvss","old":null,"new":"4.3"},{"seq":178242,"id":"CVE-2026-87550","ts":1789346377624,"field":"severity","old":"none","new":"medium"},{"seq":177036,"id":"CVE-2026-87550","ts":1789343188218,"field":"cvss","old":"4.3","new":null},{"seq":177035,"id":"CVE-2026-87550","ts":1789343188218,"field":"severity","old":"medium","new":"none"},{"seq":175153,"id":"CVE-2026-87550","ts":1789334884264,"field":"cvss","old":null,"new":"4.3"},{"seq":175152,"id":"CVE-2026-87550","ts":1789334884264,"field":"severity","old":"none","new":"medium"},{"seq":173948,"id":"CVE-2026-87550","ts":1789333703396,"field":"cvss","old":"4.3","new":null},{"seq":173947,"id":"CVE-2026-87550","ts":1789333703396,"field":"severity","old":"medium","new":"none"},{"seq":172762,"id":"CVE-2026-87550","ts":1789331096632,"field":"cvss","old":null,"new":"4.3"},{"seq":172761,"id":"CVE-2026-87550","ts":1789331096632,"field":"severity","old":"none","new":"medium"}]}