CVE-2026-87507: Google Chrome XSS Vulnerability

CVE-2026-87507 Overview

CVE-2026-87507 is a user interface (UI) misrepresentation vulnerability in the Downloads component of Google Chrome versions prior to 153.0.8010.36. A remote attacker can craft an HTML page that spoofs UI elements in the browser, enabling social engineering attacks against users. The Chromium project rated the security severity as Medium and mapped the issue to [CWE-451: User Interface (UI) Misrepresentation of Critical Information].

Exploitation requires user interaction, such as visiting a malicious page and interacting with a spoofed download prompt. Successful abuse can trick users into trusting fake download indicators or misidentifying file origins.

Critical Impact
Attackers can spoof Downloads UI elements through crafted HTML to deceive users into executing or trusting malicious files.

Affected Products

Google Chrome Desktop versions prior to 153.0.8010.36
Chromium-based browsers that incorporate the affected Downloads UI code
All supported desktop platforms (Windows, macOS, Linux) running vulnerable Chrome builds

Discovery Timeline

2026-09-09 - CVE-2026-87507 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87507

Vulnerability Analysis

The vulnerability resides in how Chrome's Downloads component renders UI elements associated with file downloads. A crafted HTML page can manipulate the visual presentation of download prompts, notifications, or file metadata such that the user is misled about the nature or origin of a downloaded resource.

Because the flaw is a UI misrepresentation issue, it does not corrupt memory or grant direct code execution. Instead, it degrades the trust boundary between browser chrome and web content, undermining the visual cues users rely on when accepting downloads. The Chromium issue is tracked in the Chromium Issue Tracker #514009699.

Root Cause

The root cause is improper isolation or rendering of trusted UI content in the Downloads surface, classified as [CWE-451]. Attacker-controlled page content can influence elements that users interpret as browser-provided security indicators, allowing the download experience to be spoofed.

Attack Vector

Exploitation is network-based and requires user interaction. A victim must visit an attacker-controlled or compromised web page hosting the malicious HTML. Once loaded, the crafted content manipulates Downloads UI elements to convince the user that a malicious file is legitimate, safe, or originating from a trusted source. No authentication is required.

No public proof-of-concept or in-the-wild exploitation has been reported. See the Google Chrome Stable Update advisory for release details.

Detection Methods for CVE-2026-87507

Indicators of Compromise

Browser telemetry showing execution of files downloaded from unfamiliar or newly registered domains shortly after user navigation.
Web proxy logs referencing pages that heavily manipulate download-related DOM elements, iframes, or overlay UI patterns.
Endpoint file-write events for executables placed in user Downloads directories immediately after visits to untrusted sites.

Detection Strategies

Inspect browser installed version data across the fleet and flag any Chrome build older than 153.0.8010.36.
Correlate web gateway logs with endpoint download and process-execution events to surface suspicious download-and-run sequences.
Monitor for phishing-style landing pages that impersonate software update, PDF viewer, or document-sharing workflows.

Monitoring Recommendations

Enable enterprise reporting via Chrome Browser Cloud Management to collect download and extension telemetry.
Alert on execution of files from %USERPROFILE%\Downloads or ~/Downloads when originating from unsigned or newly observed publishers.
Track user-reported phishing incidents involving spoofed download prompts and pivot on associated URLs and file hashes.

How to Mitigate CVE-2026-87507

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints.
Force-restart Chrome after patch deployment to ensure the update is fully applied.
Audit Chromium-based browsers (Edge, Brave, Opera, Vivaldi) and apply vendor updates that incorporate the upstream fix.

Patch Information

Google addressed CVE-2026-87507 in the Stable channel with Chrome 153.0.8010.36. Refer to the Google Chrome Stable Update advisory for the full release notes and the Chromium Issue Tracker #514009699 for the underlying report.

Workarounds

Enforce Chrome auto-update policies through Group Policy, MDM, or Chrome Browser Cloud Management until all endpoints are confirmed on the patched build.
Deliver user awareness guidance emphasizing verification of download origin, file signature, and publisher before execution.
Restrict execution of downloaded binaries using application control (WDAC, AppLocker, Gatekeeper, or equivalent) to reduce impact of spoofed downloads.

bash

# Verify installed Chrome version on Linux/macOS endpoints
google-chrome --version

# Windows: query installed version from the registry
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Enforce minimum version via Chrome Enterprise policy (example JSON)
# /etc/opt/chrome/policies/managed/version_policy.json
{
  "BrowserSwitcherEnabled": false,
  "DefaultBrowserSettingEnabled": true,
  "RelaunchNotification": 2,
  "RelaunchNotificationPeriod": 86400000
}