CVE-2026-73088 | Browserslist up to 4.28.6 Stats Normalization normalizeStats prototype pollution

A vulnerability has been found in Browserslist up to 4.28.6 and classified as critical. This vulnerability affects the function normalizeStats of the component Stats Normalization. The manipulation leads to improperly controlled modification of object prototype attributes.

This vulnerability is listed as CVE-2026-73088. The attack may be initiated remotely. There is no available exploit.

The affected component should be upgraded.