{"id":"CVE-2026-87551","title":"Improper certificate validation in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic","summary":"Improper certificate validation in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. (Chromium security severity: Low)","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","cwe":["CWE-295"],"vendor":"google","product":"chrome","affected":["chrome < 153.0.8010.36"],"patched":["chrome 153.0.8010.36"],"published":"2026-09-09","updated":"2026-09-14","sourceUpdated":"2026-09-14T13:18:58.660","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87551","references":[{"url":"https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html","label":"chrome-cve-admin@google.com"},{"url":"https://issues.chromium.org/issues/540070236","label":"chrome-cve-admin@google.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-87551.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-87551"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-87551"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-14T12:51:22.597937Z"},"epss":0.0018,"epssPercentile":0.06648,"ingestedAt":"2026-09-09T01:17:17.505Z","scores":{"nvd":4.3,"vendor":3.1},"slug":"CVE-2026-87551","body":"## Overview\n\nImproper certificate validation in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. (Chromium security severity: Low)\n\n## Affected\n\n- `chrome < 153.0.8010.36`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `chrome 153.0.8010.36`\n\n## Vendor advisories\n\n- **Red Hat VEX** · updated 2026-09-25 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-87551.json)","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":202412,"id":"CVE-2026-87551","ts":1789400072426,"field":"cvss","old":null,"new":"4.3"},{"seq":202411,"id":"CVE-2026-87551","ts":1789400072426,"field":"severity","old":"none","new":"medium"},{"seq":201139,"id":"CVE-2026-87551","ts":1789397620051,"field":"cvss","old":"4.3","new":null},{"seq":201138,"id":"CVE-2026-87551","ts":1789397620051,"field":"severity","old":"medium","new":"none"},{"seq":199832,"id":"CVE-2026-87551","ts":1789395578021,"field":"cvss","old":null,"new":"4.3"},{"seq":199831,"id":"CVE-2026-87551","ts":1789395578021,"field":"severity","old":"none","new":"medium"},{"seq":199073,"id":"CVE-2026-87551","ts":1789392260144,"field":"cvss","old":"4.3","new":null},{"seq":199072,"id":"CVE-2026-87551","ts":1789392260144,"field":"severity","old":"medium","new":"none"},{"seq":197406,"id":"CVE-2026-87551","ts":1789384296679,"field":"cvss","old":null,"new":"4.3"},{"seq":197405,"id":"CVE-2026-87551","ts":1789384296679,"field":"severity","old":"none","new":"medium"},{"seq":196680,"id":"CVE-2026-87551","ts":1789383769819,"field":"cvss","old":"4.3","new":null},{"seq":196679,"id":"CVE-2026-87551","ts":1789383769819,"field":"severity","old":"medium","new":"none"},{"seq":195584,"id":"CVE-2026-87551","ts":1789380578059,"field":"cvss","old":null,"new":"4.3"},{"seq":195583,"id":"CVE-2026-87551","ts":1789380578059,"field":"severity","old":"none","new":"medium"},{"seq":194535,"id":"CVE-2026-87551","ts":1789378789288,"field":"cvss","old":"4.3","new":null},{"seq":194534,"id":"CVE-2026-87551","ts":1789378789288,"field":"severity","old":"medium","new":"none"},{"seq":193322,"id":"CVE-2026-87551","ts":1789376520703,"field":"cvss","old":null,"new":"4.3"},{"seq":193321,"id":"CVE-2026-87551","ts":1789376520703,"field":"severity","old":"none","new":"medium"},{"seq":192109,"id":"CVE-2026-87551","ts":1789373639078,"field":"cvss","old":"4.3","new":null},{"seq":192108,"id":"CVE-2026-87551","ts":1789373639078,"field":"severity","old":"medium","new":"none"},{"seq":190894,"id":"CVE-2026-87551","ts":1789369487605,"field":"cvss","old":null,"new":"4.3"},{"seq":190893,"id":"CVE-2026-87551","ts":1789369487605,"field":"severity","old":"none","new":"medium"},{"seq":189681,"id":"CVE-2026-87551","ts":1789368460670,"field":"cvss","old":"4.3","new":null},{"seq":189680,"id":"CVE-2026-87551","ts":1789368460670,"field":"severity","old":"medium","new":"none"},{"seq":188464,"id":"CVE-2026-87551","ts":1789365236624,"field":"cvss","old":null,"new":"4.3"},{"seq":188463,"id":"CVE-2026-87551","ts":1789365236624,"field":"severity","old":"none","new":"medium"},{"seq":187251,"id":"CVE-2026-87551","ts":1789363480008,"field":"cvss","old":"4.3","new":null},{"seq":187250,"id":"CVE-2026-87551","ts":1789363480008,"field":"severity","old":"medium","new":"none"},{"seq":186037,"id":"CVE-2026-87551","ts":1789361235266,"field":"cvss","old":null,"new":"4.3"},{"seq":186036,"id":"CVE-2026-87551","ts":1789361235266,"field":"severity","old":"none","new":"medium"},{"seq":184824,"id":"CVE-2026-87551","ts":1789358377005,"field":"cvss","old":"4.3","new":null},{"seq":184823,"id":"CVE-2026-87551","ts":1789358377005,"field":"severity","old":"medium","new":"none"},{"seq":183073,"id":"CVE-2026-87551","ts":1789354323123,"field":"cvss","old":null,"new":"4.3"},{"seq":183072,"id":"CVE-2026-87551","ts":1789354323123,"field":"severity","old":"none","new":"medium"},{"seq":181866,"id":"CVE-2026-87551","ts":1789353334986,"field":"cvss","old":"4.3","new":null},{"seq":181865,"id":"CVE-2026-87551","ts":1789353334986,"field":"severity","old":"medium","new":"none"},{"seq":180659,"id":"CVE-2026-87551","ts":1789350290621,"field":"cvss","old":null,"new":"4.3"},{"seq":180658,"id":"CVE-2026-87551","ts":1789350290621,"field":"severity","old":"none","new":"medium"},{"seq":179452,"id":"CVE-2026-87551","ts":1789348308276,"field":"cvss","old":"4.3","new":null},{"seq":179451,"id":"CVE-2026-87551","ts":1789348308276,"field":"severity","old":"medium","new":"none"},{"seq":178245,"id":"CVE-2026-87551","ts":1789346377630,"field":"cvss","old":null,"new":"4.3"},{"seq":178244,"id":"CVE-2026-87551","ts":1789346377630,"field":"severity","old":"none","new":"medium"},{"seq":177038,"id":"CVE-2026-87551","ts":1789343188225,"field":"cvss","old":"4.3","new":null},{"seq":177037,"id":"CVE-2026-87551","ts":1789343188225,"field":"severity","old":"medium","new":"none"},{"seq":175155,"id":"CVE-2026-87551","ts":1789334884272,"field":"cvss","old":null,"new":"4.3"},{"seq":175154,"id":"CVE-2026-87551","ts":1789334884272,"field":"severity","old":"none","new":"medium"},{"seq":173950,"id":"CVE-2026-87551","ts":1789333703402,"field":"cvss","old":"4.3","new":null},{"seq":173949,"id":"CVE-2026-87551","ts":1789333703402,"field":"severity","old":"medium","new":"none"},{"seq":172764,"id":"CVE-2026-87551","ts":1789331096638,"field":"cvss","old":null,"new":"4.3"},{"seq":172763,"id":"CVE-2026-87551","ts":1789331096638,"field":"severity","old":"none","new":"medium"}]}