CVE-2026-87445: Google Chrome Session UI Spoofing XSS Flaw

CVE-2026-87445 Overview

CVE-2026-87445 is a user interface misrepresentation vulnerability in the Session component of Google Chrome prior to version 153.0.8010.36. A remote attacker can spoof UI elements by delivering a crafted HTML page to a victim. The flaw is categorized under [CWE-451] (User Interface Misrepresentation of Critical Information) and is rated Medium severity by the Chromium security team. Successful exploitation requires user interaction, such as visiting an attacker-controlled page. The vulnerability enables phishing, address bar spoofing, and other social engineering attacks that undermine the trust signals users rely on to make security decisions in the browser.

Critical Impact
Attackers can spoof browser UI elements to deceive users into trusting malicious content, enabling credential theft and phishing campaigns.

Affected Products

Google Chrome desktop versions prior to 153.0.8010.36
Chromium-based browsers incorporating the vulnerable Session component
All operating systems supported by Chrome Stable channel

Discovery Timeline

2026-09-09 - CVE CVE-2026-87445 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87445

Vulnerability Analysis

The vulnerability resides in the Session component of Chrome, which manages browsing state including tabs, navigation history, and associated UI indicators. A crafted HTML page can manipulate how session-related UI elements render, causing the browser to display misleading information to the user. This class of flaw, tracked as [CWE-451], targets the integrity of security-critical visual signals rather than memory safety or code execution.

Exploitation requires the victim to visit an attacker-controlled page. Once loaded, the malicious content triggers the misrepresentation, causing browser chrome elements such as URL indicators, permission prompts, or navigation state to display attacker-chosen content. Users relying on these signals to evaluate site authenticity may be deceived into submitting credentials or granting sensitive permissions.

Root Cause

The root cause is improper synchronization between the Session component's state and the trusted UI surface. When session data is manipulated through specific HTML constructs, the browser fails to accurately reflect the true origin or state of the loaded content in security-relevant UI regions. See the Chromium Issue Tracker Entry for additional detail once made public.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker hosts a crafted HTML page and lures a victim to visit it through phishing emails, malicious advertisements, or compromised legitimate sites. The vulnerability does not require authentication or elevated privileges. It is most likely to be chained with phishing infrastructure to harvest credentials or trick users into approving malicious operations. No public proof-of-concept exploit or in-the-wild exploitation has been reported.

Detection Methods for CVE-2026-87445

Indicators of Compromise

Chrome browser processes reporting versions earlier than 153.0.8010.36 in endpoint inventory
User reports of URL bar, permission dialog, or tab UI that appears inconsistent with the site being visited
Web traffic to newly registered domains hosting HTML pages that manipulate session state or open unusual popup and navigation sequences

Detection Strategies

Query endpoint telemetry for installed Chrome versions and flag hosts running builds below 153.0.8010.36
Correlate proxy and DNS logs with threat intelligence for phishing domains that leverage browser spoofing techniques
Monitor for credential submission events to domains that do not match the URL displayed in security awareness training simulations

Monitoring Recommendations

Enable browser version reporting through enterprise management policies to maintain continuous visibility into patch status
Track Chrome update rollout completion across the fleet using endpoint management tooling
Ingest browser and proxy telemetry into a centralized data lake to correlate suspicious navigation patterns with user activity

How to Mitigate CVE-2026-87445

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later across all managed endpoints
Force browser restart to ensure the patched binary is active in memory
Audit Chromium-based third-party browsers (Edge, Brave, Opera, Vivaldi) for corresponding upstream fixes

Patch Information

Google released the fix in the Chrome Stable channel. Refer to the Chrome Stable Update Announcement for release details. Enterprise administrators should deploy the update through Google Update, Chrome Browser Cloud Management, or their software distribution platform. Chromium downstream vendors typically ship the fix within days of the upstream release.

Workarounds

Enforce enterprise policies that restrict browsing to allowlisted domains for users handling sensitive data until patches are applied
Reinforce user awareness training focused on verifying URLs and permission prompts before submitting credentials
Deploy web filtering to block access to known phishing infrastructure that may leverage UI spoofing techniques

bash

# Verify installed Chrome version on Windows endpoints
reg query "HKLM\Software\Google\Chrome\BLBeacon" /v version

# Verify installed Chrome version on macOS/Linux
google-chrome --version