CVE-2026-87567: Google Chrome Address Bar Spoofing Flaw

CVE-2026-87567 Overview

CVE-2026-87567 is a user interface misrepresentation vulnerability in the UrlFormatting component of Google Chrome prior to version 153.0.8010.36. A remote attacker can craft a malicious domain name that causes the Chrome address bar to display misleading content. The flaw enables address bar spoofing, supporting phishing and social engineering campaigns that impersonate trusted websites. Chromium classified the security severity as Medium. The vulnerability requires user interaction, such as visiting an attacker-controlled URL, but does not require authentication or elevated privileges. It is tracked under [CWE-451: User Interface (UI) Misrepresentation of Critical Information].

Critical Impact
Attackers can spoof the address bar to impersonate legitimate domains, increasing the success rate of phishing and credential theft campaigns targeting Chrome users.

Affected Products

Google Chrome versions prior to 153.0.8010.36
Chromium-based browsers sharing the vulnerable UrlFormatting code path
Desktop Stable channel builds for Windows, macOS, and Linux

Discovery Timeline

2026-09-09 - CVE-2026-87567 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database
2026-09-09 - Google publishes Stable Channel update announcement via the Google Chrome Update Blog

Technical Details for CVE-2026-87567

Vulnerability Analysis

The vulnerability resides in Chrome's UrlFormatting logic, which is responsible for rendering URLs in the omnibox. When Chrome formats a specifically crafted domain name, the displayed representation diverges from the actual navigation target. This mismatch enables an attacker to make a malicious page appear to originate from a trusted domain.

UI misrepresentation flaws in the address bar undermine a core browser security guarantee: users rely on the omnibox as the authoritative indicator of site identity. When the rendered URL no longer matches the loaded origin, standard phishing indicators break down.

Exploitation requires social engineering. The attacker must lure a victim to a crafted URL, typically through a phishing email, malicious advertisement, or compromised web content. No memory corruption or code execution occurs; the impact is limited to integrity of the URL display.

Root Cause

The root cause is improper handling of specific character sequences or domain-name constructs during URL formatting in the omnibox. The formatter fails to normalize or visually distinguish characters that can be composed to mimic legitimate hostnames. This aligns with [CWE-451], where security-relevant information is displayed inaccurately to the user.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker hosts a malicious page under a crafted domain name and delivers the URL to a victim through email, chat, search results, or ad networks. When the victim clicks the link in a vulnerable Chrome build, the omnibox renders a URL that appears to belong to a trusted domain while the browser actually loads attacker-controlled content. The attacker can then harvest credentials, deliver drive-by content, or stage further social engineering. Verified proof-of-concept code is not publicly available. Additional technical context is tracked in the Chromium Issue Tracker Entry.

Detection Methods for CVE-2026-87567

Indicators of Compromise

Chrome browser processes navigating to newly registered or lookalike domains from email or messaging clients
Outbound DNS queries to domains containing unusual Unicode, punycode (xn--), or mixed-script character sets
User reports of URLs in the address bar not matching the expected destination after clicking a link
Credential submissions to domains that visually resemble corporate SaaS or banking sites

Detection Strategies

Inspect proxy and DNS telemetry for domains with high visual similarity to protected brands, using homoglyph and typosquatting analytics
Correlate Chrome version telemetry from endpoint inventory with the fixed version 153.0.8010.36 to identify unpatched hosts
Alert on navigations initiated from email clients or messaging platforms to domains registered within the last 30 days
Monitor for phishing kits and credential capture patterns in web gateway logs, especially POST requests to lookalike hostnames

Monitoring Recommendations

Ingest browser, DNS, and web proxy logs into a centralized analytics platform to enable cross-source correlation
Track Chrome version distribution across the fleet and generate alerts for hosts running builds below 153.0.8010.36
Enable user reporting workflows so employees can flag suspicious address bar behavior directly to the security team
Continuously monitor threat intelligence feeds for phishing infrastructure targeting your organization's brand and executives

How to Mitigate CVE-2026-87567

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints across Windows, macOS, and Linux
Force a browser restart after deployment to ensure the patched UrlFormatting code is loaded
Verify that Chromium-derived browsers used in the environment have incorporated the upstream fix
Reinforce phishing awareness training with an emphasis on validating destination URLs beyond visual inspection

Patch Information

Google addressed CVE-2026-87567 in the Stable Channel update for Desktop. Full release details are published in the Google Chrome Update Blog. Administrators should deploy Chrome 153.0.8010.36 or later through their standard software distribution tooling. The corresponding upstream fix is tracked in the Chromium Issue Tracker Entry.

Workarounds

Enforce enterprise browser policies that block navigation to newly registered domains through DNS filtering or secure web gateways
Deploy URL reputation and anti-phishing services at the network edge to flag lookalike domains before pages render
Restrict use of vulnerable Chrome builds via conditional access policies until patching is complete
Encourage users to hover over links and expand shortened URLs before clicking, particularly in unsolicited messages

bash

# Verify Chrome version on Linux endpoints and flag hosts below the fixed build
google-chrome --version | awk '{print $3}' | \
  awk -F. '{ if ($1 < 153 || ($1==153 && $2==0 && $3 < 8010)) print "VULNERABLE"; else print "PATCHED" }'