What is the CVSS score of CVE-2026-87571?

CVE-2026-87571 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-87571?

Yes, a patch is available for CVE-2026-87571. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-87571

EUVD-2026-74471 MEDIUM

Improper Certificate Validation (CWE-295)

2026-09-09 Chrome

GHSA-fvc9-68gg-69q8

Google

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Network-delivered via crafted traffic; social engineering satisfies UI:R; no privileges required; limited cross-origin confidentiality and integrity loss only.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Metadata Corrected

Sep 10, 2026 - 14:40 vuln.today

tag: Authentication Bypass removed

Analysis Generated

Sep 10, 2026 - 14:25 vuln.today

CVSS changed

Sep 10, 2026 - 14:22 NVD

5.4 (MEDIUM)

Patch available

Sep 09, 2026 - 01:03 EUVD

CVE Published

Sep 09, 2026 - 00:10 nvd

MEDIUM 5.4

CVE Published

Sep 09, 2026 - 00:10 cve.org

UNKNOWN (no severity yet)

DescriptionNVD

Improper certificate validation in Loader in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. (Chromium security severity: Low)

AnalysisAI

Improper certificate validation in Google Chrome's Loader component (prior to 153.0.8010.36) enables remote attackers to bypass the browser's web origin policy via crafted network traffic combined with social engineering. The flaw (CWE-295) permits partial cross-origin data access and integrity impact, rated Low severity by Chromium's own classification despite a CVSS base score of 5.4. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires active user interaction via social engineering - the victim must be persuaded to visit an attacker-controlled site or engage with crafted network content (captured by UI:R in the CVSS vector). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	Real-world risk is moderate-to-low despite Chrome's ubiquitous deployment. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Update Google Chrome to version 153.0.8010.36 or later via Chrome's built-in updater or via enterprise deployment tools. … Detailed patch versions, workarounds, and compensating controls in full report.