Improper certificate validation in Loader in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass… (CVE-2026-87571)
Source GCVE Database
Not known to be exploited · fixed in 153.0.8010.36 : update affected systems when convenient.
Data as of 10/25/2026, 04:40:14 UTC
CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 5% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 153.0.8010.36
What to do
AI-suggested
A fix is available in Google Chrome version 153.0.8010.36 and later. Users and administrators should update to this version or newer to remediate the vulnerability. No additional mitigations are specified by the vendor.
Description
An improper certificate validation vulnerability exists in the Loader component of Google Chrome versions prior to 153.0.8010.36. This vulnerability allows a remote attacker, through social engineering and crafted network traffic, to bypass the web origin policy. The Chromium project classifies this issue as having low security severity.
Impact
The vulnerability allows bypassing the web origin policy, which is a fundamental security control in browsers to isolate content from different origins. However, the impact is limited by the requirement of social engineering and the low severity rating by the vendor. There are no known exploits in the wild.
Weaknesses
- CWE-295Improper Certificate Validation (opens in a new tab)
Base weaknessOWASP Top 10 A07:2025: Authentication Failures (opens in a new tab)
The product does not validate, or incorrectly validates, a certificate.