Improper encoding or escaping of output in CSS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially bypass web origin… (CVE-2026-87550)
Source GCVE Database
Not known to be exploited : update affected systems when convenient.
Data as of 10/24/2026, 17:08:27 UTC
CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 17% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
GitHub Actionschromium/chromiumpkg:github/chromium/chromiumOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
A vulnerability in Google Chrome prior to version 153.0.8010.36 involves improper encoding or escaping of output in CSS. This flaw could allow a remote attacker to potentially bypass the web origin policy by using a crafted HTML page. The issue is classified with medium severity by Chromium security. No known exploits are reported in the wild, and no patch links are provided in the available data.
Impact
If exploited, this vulnerability could allow an attacker to circumvent the web origin policy, potentially leading to unauthorized access to web resources or data that should be restricted by origin. The severity is assessed as medium by Chromium security, indicating a moderate risk level. There are no reports of active exploitation in the wild.
Summary
The vulnerability identified as CVE-2026-87550 affects Google Chrome versions before 153.0.8010.36. It stems from improper encoding or escaping of CSS output, which may enable a remote attacker to bypass the web origin policy through a specially crafted HTML page. This vulnerability relates to CWE-116 (Improper Encoding or Escaping of Output). There is no CVSS score available, and no explicit patch or remediation details are provided in the source data.