CVE-2026-87472: Google Chrome FedCM XSS Vulnerability

CVE-2026-87472 Overview

CVE-2026-87472 is an improper input validation vulnerability in the Federated Credential Management (FedCM) API of Google Chrome. The flaw affects Chrome versions prior to 153.0.8010.36. A remote attacker who has already compromised the renderer process can spoof user interface elements by serving a crafted HTML page. Google's Chromium security team rated the issue Medium severity. The vulnerability requires user interaction and prior renderer compromise, which increases the attack complexity. Exploitation would enable convincing UI spoofing that undermines identity federation prompts presented to end users.

Critical Impact
An attacker controlling a compromised renderer process can spoof FedCM UI elements, deceiving users during federated authentication flows and enabling credential-based social engineering.

Affected Products

Google Chrome Desktop versions prior to 153.0.8010.36
Chromium-based browsers that inherit the FedCM implementation
Google Chrome Stable channel on Windows, macOS, and Linux

Discovery Timeline

2026-09-09 - CVE CVE-2026-87472 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87472

Vulnerability Analysis

The vulnerability resides in Chrome's FedCM implementation, which brokers federated login flows between websites and identity providers. Improper input validation [CWE-20] in this component allows crafted HTML content to influence how UI elements render. An attacker leveraging a previously compromised renderer process can serve manipulated markup that visually mimics trusted browser chrome or identity provider prompts. The result is a UI spoofing primitive that erodes the trust boundary FedCM is designed to preserve during authentication.

Root Cause

The root cause is missing or insufficient validation of input consumed by the FedCM UI rendering path. Because the renderer is already assumed compromised in the threat model, the browser must strictly validate any data crossing into privileged UI surfaces. In vulnerable builds, that validation gap enables attacker-controlled content to shape UI elements associated with federated credential prompts.

Attack Vector

Exploitation requires two preconditions: an attacker must first compromise the Chrome renderer process, and the victim must interact with a crafted HTML page. Once those conditions are met, the attacker can present spoofed FedCM UI to trick the user into approving credential sharing or misidentifying the identity provider handling the request. The attack is delivered over the network through a malicious or compromised website. Details are tracked in the Chromium Issue Tracker Entry and the Chrome Releases Update Blog.

No verified proof-of-concept code has been published. See the referenced Chromium issue for further technical detail.

Detection Methods for CVE-2026-87472

Indicators of Compromise

Chrome browser processes running versions earlier than 153.0.8010.36 after the patch release window
Renderer process crashes or anomalous child process behavior preceding FedCM authentication events
Outbound connections from browser hosts to unfamiliar identity provider endpoints during federated login attempts

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build below 153.0.8010.36
Monitor endpoint telemetry for renderer sandbox escapes or exploitation attempts targeting Chromium components
Correlate browser process telemetry with user reports of unexpected federated login prompts or unfamiliar identity provider UI

Monitoring Recommendations

Enable browser version reporting through enterprise management policies to detect unpatched installations
Log and review FedCM-related network requests to identity providers for anomalies
Track user-reported phishing or authentication anomalies that align with FedCM prompt behavior

How to Mitigate CVE-2026-87472

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later across all managed endpoints
Restart Chrome after the update to ensure the patched binary is loaded into all processes
Communicate the fix status to end users and instruct them to verify their Chrome version via chrome://settings/help

Patch Information

Google released a fix in the Chrome Stable channel at version 153.0.8010.36. Patch details are published in the Chrome Releases Update Blog, with tracking in the Chromium Issue Tracker Entry. Chromium-based browsers should adopt the corresponding upstream fix.

Workarounds

Disable the FedCM API through enterprise policy where federated login flows are not required
Restrict browsing to trusted sites via web filtering to reduce exposure to crafted HTML payloads
Educate users to scrutinize federated authentication prompts and validate the requesting site before approving credential sharing

bash

# Verify Chrome version on Linux/macOS endpoints
google-chrome --version

# Windows PowerShell equivalent
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# Enterprise policy example to disable FedCM (chrome policy JSON)
{
  "FederatedCredentialManagementEnabled": false
}