CVE-2026-87559: Google Chrome XSS Vulnerability

CVE-2026-87559 Overview

CVE-2026-87559 is a user interface (UI) misrepresentation vulnerability in Google Chrome prior to version 153.0.8010.36. A remote attacker can craft an HTML page that spoofs browser UI elements to deceive users. Exploitation requires user interaction and social engineering, such as convincing the target to visit a malicious website.

The flaw is tracked under CWE-451: User Interface (UI) Misrepresentation of Critical Information. Chromium classifies the security severity as Medium. Successful exploitation can support phishing campaigns, address bar spoofing, and consent dialog manipulation.

Critical Impact
An attacker can spoof browser UI elements through a crafted HTML page, enabling phishing and credential theft against users who interact with the malicious content.

Affected Products

Google Chrome versions prior to 153.0.8010.36 (Desktop, Stable channel)
Chromium-based browsers that consume the same upstream code and have not integrated the fix
Any operating system on which the vulnerable Chrome build is installed

Discovery Timeline

2026-09-09 - CVE CVE-2026-87559 published to NVD
2026-09-09 - Last updated in NVD database
September 2026 - Google publishes the Stable Channel Update for Desktop addressing the issue

Technical Details for CVE-2026-87559

Vulnerability Analysis

The vulnerability resides in Chrome's UI rendering layer. A crafted HTML page can render content that overlays, imitates, or otherwise misrepresents legitimate browser chrome. Users cannot easily distinguish attacker-controlled page content from trusted browser elements such as address bars, permission prompts, or security indicators.

Because the attack is network-delivered and requires user interaction, exploitation depends on social engineering. Attackers typically pair UI spoofing with phishing lures, malvertising, or watering hole sites. The confidentiality and availability impact is limited to what the deceived user discloses or authorizes.

Additional context is available through the Chromium Issue Tracker entry.

Root Cause

The root cause is improper isolation between web content and trusted browser UI. Chrome's rendering pipeline permits page-controlled elements to visually approximate native browser controls under specific conditions. This aligns with CWE-451, where security-relevant UI can be misinterpreted by the user.

Attack Vector

Exploitation begins with the target visiting an attacker-controlled webpage or a compromised legitimate site. The page delivers HTML, CSS, and JavaScript that render fake browser elements, such as a spoofed URL bar, download prompt, or permission dialog. The user then interacts with the spoofed element, believing it belongs to the browser, and may disclose credentials or approve unintended actions.

No verified proof-of-concept code is published for this CVE. Refer to the vendor advisory and Chromium issue tracker for technical specifics.

Detection Methods for CVE-2026-87559

Indicators of Compromise

Chrome browser processes rendering pages from newly registered or low-reputation domains that mimic trusted brands
Endpoint reports of Chrome versions below 153.0.8010.36 remaining in production after the patch release
User reports of unexpected credential prompts, permission dialogs, or address bar inconsistencies

Detection Strategies

Inventory browser versions across managed endpoints and flag any Chrome build older than 153.0.8010.36
Correlate web proxy logs with threat intelligence feeds to identify traffic to phishing and typosquatting infrastructure
Monitor DNS and TLS Server Name Indication (SNI) telemetry for domains impersonating internal applications or SaaS login portals

Monitoring Recommendations

Enable centralized browser telemetry to track version compliance and extension inventory
Ingest web gateway and endpoint logs into a security data lake for correlation with phishing indicators
Alert on user-reported phishing submissions and expedite triage for URLs opened in outdated Chrome builds

How to Mitigate CVE-2026-87559

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all Desktop platforms
Force a browser restart through group policy or mobile device management (MDM) to complete the update
Verify Chromium-based third-party browsers have integrated the corresponding upstream fix
Reinforce phishing awareness training with emphasis on verifying URL bar contents and permission prompts

Patch Information

Google released the fix in the Stable Channel update documented in the Chrome Releases blog. Administrators should confirm deployment of Chrome 153.0.8010.36 or newer. Enterprise environments using Chrome Browser Cloud Management or group policy should validate the auto-update channel is not disabled.

Workarounds

Restrict browsing to allowlisted domains through a secure web gateway until patching completes
Deploy phishing-resistant authentication such as FIDO2 security keys to blunt credential theft from spoofed prompts
Enable Enhanced Safe Browsing in Chrome to increase warnings on suspicious pages

bash

# Verify installed Chrome version on Windows endpoints
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Verify installed Chrome version on macOS endpoints
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString

# Verify installed Chrome version on Linux endpoints
google-chrome --version