CVE-2026-87538: Google Chrome Clickjacking Vulnerability

CVE-2026-87538 Overview

CVE-2026-87538 is a clickjacking vulnerability in the Input component of Google Chrome versions prior to 153.0.8010.36. The flaw allows a remote attacker who has already compromised the renderer process to spoof user interface (UI) elements through a crafted HTML page. Successful exploitation additionally requires social engineering to trick the victim into interacting with the manipulated interface. Chromium classifies the underlying security severity as Low, and the issue is tracked under CWE-1021: Improper Restriction of Rendered UI Layers or Frames.

Critical Impact
An attacker controlling the renderer process can present deceptive UI overlays that lead users to perform unintended actions in Chrome, potentially exposing limited confidentiality and availability.

Affected Products

Google Chrome Desktop versions prior to 153.0.8010.36
Chromium-based browsers sharing the vulnerable Input component code
All supported desktop platforms (Windows, macOS, Linux) running affected Chrome builds

Discovery Timeline

2026-09-09 - CVE-2026-87538 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87538

Vulnerability Analysis

The vulnerability resides in the Input component of Chrome's rendering pipeline. Chrome's UI relies on trust boundaries between browser chrome and web content. This flaw permits an attacker who has already gained control of the renderer process to draw or overlay content that mimics legitimate browser UI. The attack requires user interaction, meaning the victim must click or otherwise engage with the crafted page.

Exploitation is contingent on two conditions. First, the attacker must have compromised the renderer process through a prior vulnerability. Second, the attacker must lure the user through social engineering to interact with the spoofed elements. This chained requirement is reflected in the high attack complexity classification.

The impact is bounded because renderer compromise is a prerequisite. The clickjacking condition itself does not grant new code execution primitives, but it enables deception that can amplify follow-on abuse, such as approving sensitive prompts or exposing browser state.

Root Cause

The root cause is improper restriction of rendered UI layers, categorized as CWE-1021. Chrome's Input handling logic fails to sufficiently isolate trusted browser UI elements from renderer-controlled content, allowing a compromised renderer to spoof interface elements that appear authentic to the user.

Attack Vector

An attacker delivers a crafted HTML page that, after compromising the renderer, overlays or imitates browser UI elements. The victim receives a phishing link or visits an attacker-controlled site. Social engineering convinces the user to interact with the overlaid content. The interaction triggers actions the user did not intend, such as confirming permissions or interacting with spoofed dialogs.

No verified proof-of-concept code is publicly available for this vulnerability. Refer to the Chromium Issue Tracker #522399466 and the Google Chrome Desktop Update for authoritative technical detail.

Detection Methods for CVE-2026-87538

Indicators of Compromise

Chrome renderer processes loading HTML pages that render iframes or overlays imitating browser chrome elements such as address bars, permission prompts, or download bars.
Outbound connections from Chrome to newly registered or low-reputation domains delivering pages with aggressive z-index layering or full-viewport overlays.
Endpoint telemetry showing Chrome processes below version 153.0.8010.36 after the patch release date.

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any instance older than 153.0.8010.36.
Correlate web proxy logs with threat intelligence feeds for domains hosting phishing or UI-spoofing content targeting Chrome users.
Monitor for renderer process anomalies that may indicate prior compromise required to chain into this vulnerability.

Monitoring Recommendations

Enable browser telemetry forwarding to a central logging platform to track Chrome version drift and suspicious page loads.
Alert on user reports of unexpected browser prompts, permission requests, or UI elements appearing outside normal workflows.
Track patch compliance metrics for Chrome and Chromium-based browsers as part of regular vulnerability management reporting.

How to Mitigate CVE-2026-87538

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all Windows, macOS, and Linux endpoints.
Verify that Chromium-based browsers in the environment have absorbed the upstream patch and are running current builds.
Reinforce user awareness training that highlights browser-based social engineering and UI spoofing techniques.

Patch Information

Google addressed CVE-2026-87538 in the Stable channel release of Chrome 153.0.8010.36. Deployment details are documented in the Google Chrome Desktop Update announcement. Enterprise administrators should push the update through managed browser policies or endpoint management platforms and confirm restart compliance to activate the fix.

Workarounds

No vendor-supplied workarounds exist; patching is the required remediation path.
Restrict browsing to trusted sites via enterprise browser policies where feasible until patches are fully deployed.
Enable Enhanced Safe Browsing in Chrome to increase protection against phishing pages that could deliver the crafted HTML payload.

bash

# Verify installed Chrome version on Linux/macOS
google-chrome --version

# Windows: check via registry or Chrome policy
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv