PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-87551 Google CVE debrief

CVE-2026-87551 is a medium-severity vulnerability in Google Chrome prior to 153.0.8010.36, allowing a remote attacker to bypass web origin policy via crafted network traffic by improperly validating certificates in CORS. This vulnerability requires social engineering tactics to exploit. Defenders should assess exposure and prioritize updates to 153.0.8010.36 or later. The CVE record and NVD entry provide details on the vulnerability and affected Chrome versions, but additional verification is necessary to confirm affected deployments and ensure proper mitigation.

Vendor
Google
Product
Chrome
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-09
Original CVE updated
2026-09-14
Advisory published
2026-09-09
Advisory updated
2026-09-14

Who should care

Defenders responsible for Google Chrome deployments, security teams, and vulnerability management teams should assess exposure and prioritize updates to 153.0.8010.36 or later. Additionally, operators and administrators of Chrome-based systems should be aware of the potential risks and take necessary precautions to prevent bypass attempts.

Why it matters

CVE-2026-87551 is a medium-severity vulnerability in Google Chrome that allows a remote attacker to bypass web origin policy via crafted network traffic. Defenders should prioritize verifying Chrome versions and updating to 153.0.8010.36 or later.

  • Verify Chrome version and update to 153.0.8010.36 or later to prevent bypass attempts
  • Educate users on social engineering tactics to reduce risk
  • Monitor network traffic for potential bypass attempts to detect potential attacks

Technical summary

The vulnerability is caused by improper certificate validation in CORS in Google Chrome prior to 153.0.8010.36. This allows a remote attacker to bypass web origin policy via crafted network traffic, leveraging social engineering tactics. The vulnerability affects Google Chrome deployments and requires verification of Chrome versions and updates to 153.0.8010.36 or later.

Defensive priority

Defenders should prioritize verifying Chrome versions and updating to 153.0.8010.36 or later.

Recommended defensive actions

  • Verify Chrome version and update to 153.0.8010.36 or later
  • Monitor network traffic for potential bypass attempts
  • Educate users on social engineering tactics

Evidence notes

The CVE record and NVD entry provide details on the vulnerability and affected Chrome versions. However, defenders should verify Chrome versions and configurations in their environments to assess exposure. Additional review of network traffic and user interactions may be necessary to detect potential bypass attempts. The vulnerability details are based on the official CVE Program record and NIST NVD assessment, but further validation is recommended.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-87551 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-87551

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-87551 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-87551

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.