CVE-2026-87562: Google Chrome XSS Vulnerability

CVE-2026-87562 Overview

CVE-2026-87562 is a UI spoofing vulnerability in the Accessibility component of Google Chrome on macOS. Versions prior to 153.0.8010.36 incorrectly resolve accessibility references, allowing a remote attacker to spoof interface elements through a crafted HTML page. The flaw is classified under CWE-706: Use of Incorrectly-Resolved Name or Reference. Chromium security engineers rated the issue as Medium severity. Successful exploitation requires user interaction with an attacker-controlled page, but no privileges or authentication.

Critical Impact
Attackers can spoof Chrome UI elements on macOS to mislead users, enabling phishing and social engineering against victims who visit a crafted web page.

Affected Products

Google Chrome on macOS prior to 153.0.8010.36
Apple macOS (as the affected platform runtime)
Chromium-based accessibility subsystem on Mac builds

Discovery Timeline

2026-09-09 - CVE-2026-87562 published to the National Vulnerability Database
2026-09-09 - Google publishes the Stable Channel Update for Desktop referencing the fix
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87562

Vulnerability Analysis

The vulnerability resides in Chrome's Accessibility subsystem, which exposes a structured representation of page content to assistive technologies. Chrome maintains references between accessibility nodes and their underlying DOM objects. When these references are resolved incorrectly, the browser can associate accessibility metadata with the wrong element or frame. An attacker leverages this inconsistency to make browser-rendered UI elements appear to represent trusted content when they do not.

Because the flaw affects the browser's own UI rendering path rather than page content alone, the deception can cross the boundary between web content and browser chrome. This makes the issue more impactful than a typical in-page spoof. Exploitation requires the victim to load a crafted HTML page, which aligns with the CVSS user interaction requirement.

Root Cause

The root cause is incorrect reference resolution within the accessibility tree on macOS builds of Chrome. Under specific conditions, the code path that maps accessibility identifiers to their target objects returns or accepts a mismatched reference. This mismatch enables an attacker to influence which element is described or highlighted by the accessibility layer. The condition is specific to the macOS platform integration and does not affect other operating systems in this advisory.

Attack Vector

Exploitation is remote and requires the target to visit a crafted HTML page in a vulnerable Chrome build on macOS. The attacker constructs DOM structures and accessibility attributes that trigger the flawed reference resolution. The result is a spoofed UI element that can mimic legitimate browser or page components, supporting phishing lures or consent dialog impersonation. No authentication is required, and complexity is low, but the impact is limited to integrity of displayed content.

See the Chromium Issue Tracker #513135531 for technical context once the entry is made public.

Detection Methods for CVE-2026-87562

Indicators of Compromise

Chrome on macOS reporting a version string below 153.0.8010.36 in chrome://version.
Web pages that instantiate large or unusual aria-* attribute graphs combined with dynamic frame reparenting.
Endpoint telemetry showing Chrome navigations to newly registered domains hosting HTML pages that impersonate login or consent flows.

Detection Strategies

Inventory installed Chrome versions across macOS fleets and flag hosts running builds earlier than 153.0.8010.36.
Correlate browser process telemetry with DNS and proxy logs to surface visits to domains delivering suspected spoofing pages.
Monitor user reports of unexpected Chrome dialogs, permission prompts, or address bar anomalies on macOS endpoints.

Monitoring Recommendations

Track Chrome auto-update health on macOS and alert on machines that fail to receive the 153.0.8010.36 update within the expected window.
Ingest browser and endpoint logs into a centralized data lake to enable version-based hunting queries.
Add phishing-focused URL categorization to web proxy policies to reduce exposure to crafted HTML pages that leverage spoofing bugs.

How to Mitigate CVE-2026-87562

Immediate Actions Required

Update Google Chrome on all macOS endpoints to version 153.0.8010.36 or later.
Restart Chrome after the update installs so the new binary takes effect for all user sessions.
Validate deployment by checking chrome://settings/help on a sample of managed macOS devices.

Patch Information

Google addressed CVE-2026-87562 in the Stable Channel release documented in the Google Chrome Desktop Update. Administrators should ensure managed macOS Chrome installations receive 153.0.8010.36 or a later Stable build. Environments using Chrome Enterprise policies should confirm that ComponentUpdatesEnabled and update cadence policies do not delay rollout beyond acceptable exposure windows.

Workarounds

Restrict browsing to trusted sites via enterprise web filtering until patching is complete on all macOS endpoints.
Enable Enhanced Safe Browsing in Chrome to increase warning coverage for phishing-adjacent pages.
Communicate user awareness guidance highlighting the risk of UI spoofing and encouraging verification of address bar contents before entering credentials.

bash

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Force an update check via the built-in updater
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent -runMode oneshot -userInitiated YES