CVE-2026-73088 browserslist CVE debrief

Who should care

Defenders responsible for configuring and maintaining Browserslist, as well as developers using the tool in their projects, should be aware of this vulnerability and take steps to verify and update their configurations.

Why it matters

CVE-2026-73088 is a high-severity vulnerability in Browserslist that requires verification and update to prevent potential security consequences.

• Potential for TypeError or prototype modification
• Need for verification and update of Browserslist to version 4.28.7 or later
• Importance of secure configuration and data processing

Technical summary

The vulnerability in Browserslist allows an attacker to cause a TypeError or modify the prototype of a returned object by processing untrusted data with an unguarded loop and plain-object bracket access. The issue is fixed in version 4.28.7. This vulnerability is caused by the normalizeStats() function in node.js, which processes untrusted browserslist-stats.json, opts.stats, and CLI --stats data without proper validation. As a result, inherited Object.prototype keys, including __proto__, toString, valueOf, constructor, hasOwnProperty, and isPrototypeOf, can cause an uncaught TypeError or modify the prototype of the returned normalized object.

Defensive priority

Defenders should prioritize verifying and updating Browserslist to version 4.28.7 or later, and review their usage of the tool to ensure secure configuration and data processing.

Recommended defensive actions

• Verify and update Browserslist to version 4.28.7 or later
• Review usage of Browserslist to ensure secure configuration and data processing
• Monitor for potential security advisories and updates from the vendor
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the fixed version. However, additional information on affected systems, exploitation, and potential consequences is limited.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.