Improper input validation in Network in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted… (CVE-2026-87573)
Source GCVE Database
Not known to be exploited.
Data as of 10/25/2026, 04:40:14 UTC
CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 17% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
What to do
AI-suggested
Users and administrators should monitor official Google Chrome security advisories for updates and apply the official fix once it becomes available. Until then, no specific mitigation steps are provided.
Description
An input validation vulnerability in the Network component of Google Chrome prior to version 153.0.8010.36 allows a remote attacker to bypass the web origin policy using a crafted HTML page. This vulnerability is classified with medium severity by Chromium. No CVSS score or exploit in the wild has been reported. No patch information is currently available.
Impact
Successful exploitation could allow an attacker to bypass the web origin policy, potentially enabling unauthorized access to web resources or data that should be isolated by origin boundaries. This could lead to information disclosure or cross-origin attacks. However, the severity is assessed as medium and no active exploitation has been reported.
Weaknesses
- CWE-20Improper Input Validation (opens in a new tab)
Class weaknessLikelihood of exploit: HighCWE Top 25 (2025): #18OWASP Top 10 A05:2025: Injection (opens in a new tab)
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
MITRE discourages mapping vulnerabilities to this broad entry; the root cause is usually a more specific weakness.