CVE-2026-87501 Overview
CVE-2026-87501 is a UI misrepresentation vulnerability in the Passwords component of Google Chrome prior to version 153.0.8010.36. A remote attacker can spoof user interface elements by serving a crafted HTML page. The flaw is categorized under [CWE-451: User Interface (UI) Misrepresentation of Critical Information] and carries a Chromium security severity rating of Medium.
Exploitation requires user interaction. A victim must load an attacker-controlled page for the spoofed UI to render. Successful abuse could mislead users into trusting attacker-influenced content in password-related UI surfaces, enabling phishing or credential-harvesting scenarios.
Critical Impact
Attackers can spoof password-related UI elements in Chrome to deceive users and facilitate credential theft through convincing phishing overlays.
Affected Products
- Google Chrome Desktop versions prior to 153.0.8010.36
- Chromium-based browsers that incorporate the vulnerable Passwords component
- All supported desktop platforms (Windows, macOS, Linux) running affected Chrome builds
Discovery Timeline
- 2026-09-09 - CVE CVE-2026-87501 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-87501
Vulnerability Analysis
The vulnerability resides in Chrome's Passwords feature, which manages saved credentials and related browser UI prompts. A crafted HTML page can manipulate rendering behavior so that browser-origin UI elements appear alongside or blended with attacker-controlled content. Users cannot reliably distinguish authentic browser chrome from spoofed content.
This class of flaw undermines the trust boundary between web content and browser UI. When the Passwords component displays prompts such as save-password bars, autofill dropdowns, or credential dialogs, users depend on visual authenticity to make security decisions. UI misrepresentation breaks that assumption.
The attack requires network delivery and user interaction. It does not grant code execution or direct data disclosure on its own, but it becomes powerful when chained with credential-harvesting workflows.
Root Cause
The root cause is classified as [CWE-451], where security-relevant information rendered by the browser can be visually misrepresented by web content. Chromium issue tracker entry Chromium Issue #513509804 documents the specific defect in the Passwords subsystem. The fix ships in Chrome 153.0.8010.36.
Attack Vector
An attacker hosts a malicious HTML page and lures a victim to visit it through phishing, malvertising, or a compromised site. The page uses crafted markup, styling, or timing to overlap or imitate Chrome's password UI. The victim, believing the prompt is authentic browser UI, may enter or confirm credentials that the attacker then captures. See the Google Chrome Stable Update advisory for release details.
No verified exploit code is publicly available. The vulnerability mechanism is described in prose based on the vendor advisory.
Detection Methods for CVE-2026-87501
Indicators of Compromise
- Users reporting unexpected Chrome password save or autofill prompts on unfamiliar websites
- Web pages containing overlays, iframes, or absolutely positioned elements that mimic Chrome's password bar styling
- Outbound credential submissions to domains that do not match the visible address bar context
Detection Strategies
- Inventory Chrome installations across managed endpoints and flag any version below 153.0.8010.36
- Inspect proxy and DNS telemetry for phishing infrastructure delivering credential-harvesting pages
- Correlate browser version telemetry with user reports of suspicious password prompts to identify targeted users
Monitoring Recommendations
- Enable browser management telemetry to track Chrome version rollout status across the fleet
- Monitor email and web gateway logs for links to newly registered or low-reputation domains hosting crafted HTML
- Alert on repeated authentication failures that may indicate credentials were captured via spoofed UI
How to Mitigate CVE-2026-87501
Immediate Actions Required
- Update Google Chrome to version 153.0.8010.36 or later on all desktop endpoints
- Force a browser restart through enterprise policy to ensure the patch takes effect
- Communicate the risk to users and reinforce that legitimate Chrome password prompts originate from browser chrome, not web content
Patch Information
Google released the fix in the Chrome Stable channel at version 153.0.8010.36. Refer to the Google Chrome Stable Update release notes and the tracking entry at Chromium Issue #513509804. Chromium-based browsers should incorporate the upstream fix in their next security refresh.
Workarounds
- Disable Chrome's built-in password manager via enterprise policy and require an external credential manager until patching completes
- Restrict browsing to trusted destinations using URL filtering while the update is deployed
- Train users to verify domain names in the address bar before responding to any password-related prompt
# Configuration example: enforce minimum Chrome version via enterprise policy
# Windows Group Policy path:
# Computer Configuration > Administrative Templates > Google > Google Chrome
# Set: TargetVersionPrefix = 153.0.8010.36
# Set: RelaunchNotification = Required
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
