CVE-2026-87502: Google Chrome Fullscreen XSS Vulnerability

CVE-2026-87502 Overview

CVE-2026-87502 is a confused deputy vulnerability [CWE-441] in the Fullscreen component of Google Chrome versions prior to 153.0.8010.36. The flaw allows a remote attacker who has already compromised the renderer process to spoof user interface elements through a crafted HTML page combined with social engineering. Successful exploitation requires user interaction and enables UI spoofing that can mislead users into trusting attacker-controlled content. Chromium security rates this issue as Low severity, and Google addressed it in the stable channel update for desktop.

Critical Impact
Attackers with an already-compromised renderer process can spoof browser UI elements in fullscreen mode, potentially tricking users into disclosing credentials or approving malicious actions.

Affected Products

Google Chrome for Desktop versions prior to 153.0.8010.36
Chromium-based browsers sharing the vulnerable Fullscreen implementation
All supported desktop operating systems running affected Chrome builds

Discovery Timeline

2026-09-09 - CVE-2026-87502 published to NVD
2026-09-09 - Last updated in NVD database
2026-09 - Google releases Chrome 153.0.8010.36 stable channel update addressing the issue

Technical Details for CVE-2026-87502

Vulnerability Analysis

The vulnerability is a confused deputy weakness [CWE-441] in Chrome's Fullscreen feature. A confused deputy occurs when a privileged component performs an action on behalf of a less-privileged caller without validating whether the caller should be authorized for that action. In this case, the Fullscreen implementation acts on renderer-provided input in a way that lets an attacker manipulate what the user sees. Exploitation requires the attacker to have already compromised the renderer process and to leverage social engineering, which limits real-world impact. The attack chain results in UI spoofing rather than code execution or data theft directly.

Root Cause

The root cause lies in insufficient validation between the browser process and the compromised renderer when handling Fullscreen state transitions and overlay rendering. The browser trusts renderer-supplied context to determine how UI chrome and fullscreen content are drawn, allowing a malicious renderer to influence trusted UI regions. Refer to Chromium Issue Tracker #515426792 for the upstream technical discussion.

Attack Vector

The attack requires network delivery of a crafted HTML page and user interaction. An attacker must first compromise the renderer process through a separate vulnerability, then serve HTML that triggers Fullscreen transitions to spoof address bar contents, permission prompts, or system dialogs. The user is then socially engineered into acting on the spoofed UI, for example entering credentials into a fake login overlay. Attack complexity is high because it depends on chaining a renderer compromise with a convincing social engineering scenario.

No public proof-of-concept code is available for this issue. See the Google Chrome Stable Update for release-level details.

Detection Methods for CVE-2026-87502

Indicators of Compromise

Chrome browser processes running versions earlier than 153.0.8010.36 in the enterprise fleet
Unexpected transitions to fullscreen mode immediately followed by credential input or permission grants
Renderer process crashes or anomalies preceding fullscreen UI interactions
Outbound connections to newly registered domains hosting HTML pages that trigger fullscreen immediately on load

Detection Strategies

Inventory Chrome installations across managed endpoints and flag any build older than 153.0.8010.36 for prioritized patching
Correlate renderer sandbox escape indicators with subsequent fullscreen API usage in browser telemetry
Alert on user reports of unexpected browser UI behavior, spoofed address bars, or unusual permission prompts

Monitoring Recommendations

Ingest Chrome update and version telemetry into a central logging pipeline to track patch compliance
Monitor endpoint process trees for Chrome renderer crashes correlated with navigation to untrusted domains
Track web filtering logs for user visits to unknown sites that trigger fullscreen behavior shortly after load

How to Mitigate CVE-2026-87502

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all managed desktops
Enforce automatic Chrome updates through enterprise policy to close the exposure window
Communicate to users that legitimate credential prompts and system dialogs never originate from fullscreen web content

Patch Information

Google released the fix in the Chrome stable channel update documented at the Google Chrome Stable Update advisory. Upgrading to 153.0.8010.36 or a later stable build remediates CVE-2026-87502. Chromium-based browser vendors should incorporate the corresponding upstream fix referenced in Chromium Issue Tracker #515426792.

Workarounds

Disable the Fullscreen API for untrusted origins using enterprise policy where feasible
Restrict browsing to trusted sites via web filtering until patches are deployed
Train users to press Esc if a page unexpectedly enters fullscreen and to verify UI elements outside of fullscreen mode

bash

# Example: enforce Chrome auto-update and minimum version via enterprise policy (Windows registry)
reg add "HKLM\Software\Policies\Google\Update" /v UpdateDefault /t REG_DWORD /d 1 /f
reg add "HKLM\Software\Policies\Google\Chrome" /v FullscreenAllowed /t REG_DWORD /d 0 /f