Executive brief
Google Chrome's network component contains an input validation flaw that allows attackers to bypass the browser's web origin policy through a specially crafted HTML page. This could enable malicious websites to access resources or data from other origins, potentially compromising user privacy and security across websites.
Technical details
The vulnerability is an improper input validation flaw in the Network component of Google Chrome. It allows a remote attacker to bypass the same-origin policy (SOP) via a crafted HTML page. The attack is network-based and requires no authentication or user interaction beyond visiting a malicious website. An attacker can exploit this to access cross-origin resources or data that should be protected by browser security boundaries. The vulnerability was fixed in Chrome version 153.0.8010.36 released on September 8, 2026.
Affected products
- Google Chrome prior to 153.0.8010.36
Timeline
- 2026-09-09: disclosed: CVE-2026-87573 advisory published on NVD
- 2026-09-08: patched: Fixed in Chrome 153.0.8010.36 released to stable channel