CVE-2026-87559 Overview
CVE-2026-87559 is a user interface (UI) misrepresentation vulnerability in Google Chrome prior to version 153.0.8010.36. A remote attacker can craft an HTML page that spoofs browser UI elements to deceive users. Exploitation requires user interaction and social engineering, such as convincing the target to visit a malicious website.
The flaw is tracked under CWE-451: User Interface (UI) Misrepresentation of Critical Information. Chromium classifies the security severity as Medium. Successful exploitation can support phishing campaigns, address bar spoofing, and consent dialog manipulation.
Critical Impact
An attacker can spoof browser UI elements through a crafted HTML page, enabling phishing and credential theft against users who interact with the malicious content.
Affected Products
- Google Chrome versions prior to 153.0.8010.36 (Desktop, Stable channel)
- Chromium-based browsers that consume the same upstream code and have not integrated the fix
- Any operating system on which the vulnerable Chrome build is installed
Discovery Timeline
- 2026-09-09 - CVE CVE-2026-87559 published to NVD
- 2026-09-09 - Last updated in NVD database
- September 2026 - Google publishes the Stable Channel Update for Desktop addressing the issue
Technical Details for CVE-2026-87559
Vulnerability Analysis
The vulnerability resides in Chrome's UI rendering layer. A crafted HTML page can render content that overlays, imitates, or otherwise misrepresents legitimate browser chrome. Users cannot easily distinguish attacker-controlled page content from trusted browser elements such as address bars, permission prompts, or security indicators.
Because the attack is network-delivered and requires user interaction, exploitation depends on social engineering. Attackers typically pair UI spoofing with phishing lures, malvertising, or watering hole sites. The confidentiality and availability impact is limited to what the deceived user discloses or authorizes.
Additional context is available through the Chromium Issue Tracker entry.
Root Cause
The root cause is improper isolation between web content and trusted browser UI. Chrome's rendering pipeline permits page-controlled elements to visually approximate native browser controls under specific conditions. This aligns with CWE-451, where security-relevant UI can be misinterpreted by the user.
Attack Vector
Exploitation begins with the target visiting an attacker-controlled webpage or a compromised legitimate site. The page delivers HTML, CSS, and JavaScript that render fake browser elements, such as a spoofed URL bar, download prompt, or permission dialog. The user then interacts with the spoofed element, believing it belongs to the browser, and may disclose credentials or approve unintended actions.
No verified proof-of-concept code is published for this CVE. Refer to the vendor advisory and Chromium issue tracker for technical specifics.
Detection Methods for CVE-2026-87559
Indicators of Compromise
- Chrome browser processes rendering pages from newly registered or low-reputation domains that mimic trusted brands
- Endpoint reports of Chrome versions below 153.0.8010.36 remaining in production after the patch release
- User reports of unexpected credential prompts, permission dialogs, or address bar inconsistencies
Detection Strategies
- Inventory browser versions across managed endpoints and flag any Chrome build older than 153.0.8010.36
- Correlate web proxy logs with threat intelligence feeds to identify traffic to phishing and typosquatting infrastructure
- Monitor DNS and TLS Server Name Indication (SNI) telemetry for domains impersonating internal applications or SaaS login portals
Monitoring Recommendations
- Enable centralized browser telemetry to track version compliance and extension inventory
- Ingest web gateway and endpoint logs into a security data lake for correlation with phishing indicators
- Alert on user-reported phishing submissions and expedite triage for URLs opened in outdated Chrome builds
How to Mitigate CVE-2026-87559
Immediate Actions Required
- Update Google Chrome to version 153.0.8010.36 or later on all Desktop platforms
- Force a browser restart through group policy or mobile device management (MDM) to complete the update
- Verify Chromium-based third-party browsers have integrated the corresponding upstream fix
- Reinforce phishing awareness training with emphasis on verifying URL bar contents and permission prompts
Patch Information
Google released the fix in the Stable Channel update documented in the Chrome Releases blog. Administrators should confirm deployment of Chrome 153.0.8010.36 or newer. Enterprise environments using Chrome Browser Cloud Management or group policy should validate the auto-update channel is not disabled.
Workarounds
- Restrict browsing to allowlisted domains through a secure web gateway until patching completes
- Deploy phishing-resistant authentication such as FIDO2 security keys to blunt credential theft from spoofed prompts
- Enable Enhanced Safe Browsing in Chrome to increase warnings on suspicious pages
# Verify installed Chrome version on Windows endpoints
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv
# Verify installed Chrome version on macOS endpoints
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString
# Verify installed Chrome version on Linux endpoints
google-chrome --version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
