The prototype pollution in Browserslist's normalizeStats() function (CVE-2026-73088) is best understood not as a developer error but as a structural failure in how the JavaScript ecosystem treats build-tool inputs. The vulnerability lives in a function that explicitly processes analytics-exported data — the kind of file generated by CI pipelines, third-party integrations, or shared team configurations. The attack surface isn't a developer misusing their own code; it's a supply chain issue where the data flowing into this function is implicitly untrusted.
The fix — adding hasOwnProperty checks to the for...in loop — is trivial. What's less trivial is recognizing that Browserslist runs during every build with millions of weekly downloads through Autoprefixer alone, yet its stats-parsing path was never treated as a security-critical surface. The underlying pattern (unguarded for...in on parsed config data) isn't unique to Browserslist — it appeared across the 2018-2019 wave of prototype pollution CVEs in JSON5, js-yaml, and merge-recursive. Each was patched in isolation. The ecosystem never produced a canonical reference model for this specific vulnerability class in build-time parsers.
The EPSS score of 0.00361 likely underweights the real risk. Prototype pollution's damage lives in gadget chains, not standalone exploitation — and in build tools, the blast radius is categorically different from request handlers. Pollution doesn't stay contained; it propagates into build artifacts, PostCSS output, and potentially the CSS/JS that ships to users. In monorepo environments where shared stats files are consumed across dozens of projects, compromising a single stats source yields multiplicative impact: one injection reaches multiple independent build pipelines simultaneously. Standard exploitation modeling, which treats each asset as independent, fundamentally misses this cascade scenario.
The open question isn't whether to patch — patch immediately. It's whether the fix in 4.28.7 addresses the full class or just this PoC, and whether the CLI path and programmatic API (opts.stats) were included. Given Browserslist's active maintenance through the years when prototype pollution became a named attack class, the years-long gap between public disclosure of the attack class and this specific patch represents systemic debt that other long-lived configuration libraries likely share. Treat any library that parses external config files into plain objects as an implicit security boundary — the same for...in pattern that works safely 99% of the time creates catastrophic failure modes when processing configuration from untrusted sources.