CVE-2026-87462: Google Chrome FedCM XSS Vulnerability

CVE-2026-87462 Overview

CVE-2026-87462 is a UI misrepresentation vulnerability in the Federated Credential Management (FedCM) component of Google Chrome. Versions prior to 153.0.8010.36 allow a remote attacker to spoof user interface elements through a crafted HTML page. Exploitation requires user interaction and leverages social engineering to deceive the victim. The flaw is tracked under [CWE-451: User Interface (UI) Misrepresentation of Critical Information]. Google classifies the Chromium security severity as Medium.

Critical Impact
Attackers can spoof FedCM authentication UI elements to trick users into approving identity federation actions they did not intend, potentially leading to credential misuse or account linkage abuse.

Affected Products

Google Chrome versions prior to 153.0.8010.36 (Desktop, Stable channel)
Chromium-based browsers embedding the vulnerable FedCM implementation
Deployments relying on FedCM for federated identity flows

Discovery Timeline

2026-09-09 - CVE CVE-2026-87462 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87462

Vulnerability Analysis

The vulnerability resides in Chrome's Federated Credential Management (FedCM) API, which brokers browser-mediated identity federation between relying parties and identity providers. A crafted HTML page can manipulate how FedCM prompts render, causing the browser to present misleading information to the user. Because the FedCM prompt is a trusted, browser-controlled surface, users have limited signals to distinguish spoofed content from legitimate identity provider prompts.

Exploitation requires the victim to visit an attacker-controlled page and interact with the manipulated UI. The impact centers on integrity of user consent decisions during federated sign-in flows.

Root Cause

The root cause is improper isolation or validation of content rendered within FedCM UI surfaces. Attributes controllable by the calling page influence how identity provider details are presented, enabling misrepresentation. This aligns with [CWE-451], where security-relevant information is displayed inaccurately to the user.

Attack Vector

The attack is network-based and requires user interaction. An attacker hosts a crafted HTML page that invokes FedCM APIs with parameters designed to produce a deceptive prompt. When a victim visits the page and interacts with the prompt, the browser may communicate misleading identity context, enabling social engineering. No prior authentication or elevated privileges are required on the target system.

No verified proof-of-concept code is publicly available. See the Chromium Issue Tracker #514041087 for technical details once access restrictions are lifted.

Detection Methods for CVE-2026-87462

Indicators of Compromise

Chrome desktop clients running versions earlier than 153.0.8010.36 in enterprise inventory.
Web traffic to unfamiliar domains that invoke FedCM (navigator.credentials.get({identity: ...})) shortly before unexpected identity provider consent events.
User reports of confusing or unexpected browser sign-in prompts on untrusted sites.

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag hosts below the patched build.
Correlate identity provider audit logs for consent grants originating from unusual relying party domains.
Inspect proxy or DNS logs for pages that programmatically invoke FedCM flows outside sanctioned relying parties.

Monitoring Recommendations

Enable Chrome Enterprise reporting to capture browser version telemetry and extension state.
Monitor identity provider (IdP) logs for anomalous federated sign-in approvals tied to newly seen domains.
Alert on user-reported UI spoofing attempts through phishing intake channels.

How to Mitigate CVE-2026-87462

Immediate Actions Required

Update Google Chrome to 153.0.8010.36 or later on all desktop platforms.
Restart browser sessions after deployment so the patched binary is loaded.
Communicate updated phishing guidance to end users, emphasizing scrutiny of federated sign-in prompts.

Patch Information

Google released the fix in the Chrome Stable channel update documented in the Google Chrome Stable Update advisory. Administrators should deploy build 153.0.8010.36 or later. Details of the underlying issue are tracked in Chromium Issue Tracker #514041087.

Workarounds

Enforce automatic Chrome updates through Chrome Enterprise policies to reduce exposure windows.
Restrict use of FedCM through the FederatedIdentityApiEnabled enterprise policy where federated identity flows are not required.
Reinforce user awareness training focused on recognizing suspicious sign-in prompts.

bash

# Example Chrome Enterprise policy to disable FedCM where not required (Linux managed policy JSON)
{
  "FederatedIdentityApiEnabled": false
}