CVE-2026-87458 Overview
CVE-2026-87458 is a UI misrepresentation vulnerability in the Geometry component of Google Chrome prior to version 153.0.8010.36. A remote attacker can craft a malicious HTML page that spoofs browser UI elements when a user visits the page. The flaw enables social engineering attacks by tricking users into trusting spoofed interface components. Google classifies the Chromium security severity as Medium. The vulnerability is tracked under [CWE-451: User Interface (UI) Misrepresentation of Critical Information].
Critical Impact
Attackers can spoof legitimate browser UI elements to deceive users into disclosing credentials, approving actions, or trusting malicious content.
Affected Products
- Google Chrome versions prior to 153.0.8010.36
- Chromium-based browsers sharing the affected Geometry rendering code
- Desktop Chrome across Windows, macOS, and Linux stable channels
Discovery Timeline
- 2026-09-09 - CVE-2026-87458 published to NVD
- 2026-09-09 - Last updated in NVD database
- 2026-09 - Google Chrome Stable channel patch released (Google Chrome Stable Update)
Technical Details for CVE-2026-87458
Vulnerability Analysis
The vulnerability resides in the Geometry component of Chrome's rendering pipeline. Chrome computes and displays UI element coordinates based on values that can be influenced by web content. A crafted HTML page can manipulate geometry calculations to draw content over trusted UI regions or misalign security indicators.
User interaction is required for exploitation. A victim must load the attacker-controlled page in a vulnerable Chrome build. Confidentiality and availability may be affected because a successful spoof can lead the user to expose data or interact with malicious surfaces believing they are legitimate.
The issue does not grant code execution or memory corruption. Its risk stems from breaking the visual trust model that users rely on to distinguish browser chrome from page content.
Root Cause
The root cause is improper validation or normalization of geometry values used to position UI elements. When page-controlled inputs influence rendering coordinates without sufficient bounds enforcement, the browser can display elements in locations that misrepresent origin or context. See Chromium Issue #517072005 for tracking details.
Attack Vector
Exploitation requires a remote attacker to deliver a crafted HTML page and convince a user to visit it. The attack proceeds over the network without authentication. Once the page loads, the malicious geometry manipulation renders spoofed UI, such as fake address bar content, permission prompts, or dialog boxes overlapping trusted browser regions. The attacker then leverages the spoofed interface to conduct phishing, credential theft, or unauthorized action approval.
No public proof-of-concept or exploit code is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2026-87458
Indicators of Compromise
- Browser telemetry showing users visiting unfamiliar domains hosting HTML with unusual CSS transforms, overlays, or absolute-positioned iframes over browser chrome regions
- Phishing reports referencing pages that appear to display Chrome dialogs, permission prompts, or address bar content inconsistently
- Web proxy logs recording repeat visits to newly registered domains preceding credential submissions
Detection Strategies
- Inventory Chrome installations across the fleet and flag any build earlier than 153.0.8010.36
- Correlate browser process telemetry with outbound connections to low-reputation domains delivering HTML with heavy geometry or overlay manipulation
- Alert on user reports of unexpected browser dialogs, prompts, or UI anomalies during web browsing sessions
Monitoring Recommendations
- Track Chrome version distribution continuously via endpoint management or EDR inventory data
- Monitor DNS and HTTP telemetry for access to newly observed domains combined with credential form submissions
- Enable enterprise browser reporting to capture unsafe site warnings and download events tied to social engineering campaigns
How to Mitigate CVE-2026-87458
Immediate Actions Required
- Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints
- Force browser restarts after policy-driven updates to ensure the patched binary is loaded
- Communicate awareness guidance to users about spoofed dialogs and unexpected permission prompts
Patch Information
Google released the fix in the Chrome Stable channel update documented at the Google Chrome Stable Update. Administrators should deploy 153.0.8010.36 or later. Chromium-based browsers derived from the affected codebase should apply the corresponding upstream fix referenced in Chromium Issue #517072005.
Workarounds
- Enforce automatic Chrome updates through enterprise policy to reduce exposure windows
- Restrict browsing to allow-listed sites for high-risk user groups until patching completes
- Reinforce phishing awareness training focused on recognizing suspicious browser prompts and verifying URLs before entering credentials
# Verify installed Chrome version on Windows endpoints
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version
# Verify installed Chrome version on macOS endpoints
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString
# Verify installed Chrome version on Linux endpoints
google-chrome --version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
