CVE-2026-87583: Google Chrome XSS Vulnerability

CVE-2026-87583 Overview

CVE-2026-87583 is a user interface (UI) misrepresentation vulnerability in the Passwords component of Google Chrome on Android. The flaw affects Chrome versions prior to 153.0.8010.36 and allows a remote attacker to spoof UI elements through a crafted HTML page. The issue is categorized under [CWE-451] (User Interface Misrepresentation of Critical Information) and requires user interaction to exploit. Chromium classified the internal security severity as Low, while NVD assigned a medium rating.

Critical Impact
A remote attacker can craft a malicious HTML page to spoof Chrome's Passwords UI on Android, potentially tricking users into disclosing credentials or trusting attacker-controlled content.

Affected Products

Google Chrome for Android prior to version 153.0.8010.36
Google Android (as the underlying platform)
Chromium-based rendering of Passwords UI on mobile

Discovery Timeline

2026-09-09 - CVE-2026-87583 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87583

Vulnerability Analysis

The vulnerability resides in the Passwords feature of Google Chrome on Android. Chrome renders password-related UI elements in a way that can be manipulated by attacker-controlled HTML content. An attacker can construct a web page that overlays or mimics native browser password prompts. Users cannot reliably distinguish the spoofed content from legitimate browser UI. The result is a social engineering primitive that undermines trust in Chrome's credential surfaces on mobile devices.

Exploitation requires the victim to visit or interact with a crafted page. No authentication or elevated privileges are required on the attacker's side. The scope of impact is limited to confidentiality and availability of the affected user session, without integrity impact to the browser itself.

Root Cause

The root cause is improper separation between web-rendered content and browser-controlled UI chrome in the Passwords component. When rendering pages on Android, Chrome does not sufficiently isolate visual elements associated with password management from arbitrary HTML and CSS supplied by the page. This falls under [CWE-451], where critical security information is displayed in a way that permits misrepresentation.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker hosts a crafted HTML page and lures a Chrome for Android user to visit it via phishing, malvertising, or a compromised site. Once loaded, the page renders visual elements that impersonate Chrome's Passwords interface. A user who trusts the spoofed prompt may enter credentials or take actions the attacker intends to capture.

No verified public proof-of-concept code is available. Technical details are tracked in the Chromium Issue Tracker #533116484.

Detection Methods for CVE-2026-87583

Indicators of Compromise

Chrome for Android clients reporting versions earlier than 153.0.8010.36 in user-agent telemetry
Web traffic to newly registered or low-reputation domains hosting HTML pages that visually replicate Chrome password prompts
User reports of unexpected password save or autofill dialogs appearing on non-login pages

Detection Strategies

Inventory managed Android fleets for Chrome versions below 153.0.8010.36 using mobile device management (MDM) reporting
Inspect proxy and secure web gateway logs for pages containing DOM structures that imitate Chrome's password UI elements
Correlate phishing report submissions with Chrome for Android user agents to prioritize investigation

Monitoring Recommendations

Enable browser telemetry and crash reporting from Chrome on Android to surface anomalous rendering events
Monitor threat intelligence feeds for phishing kits that specifically target Chrome mobile password prompts
Track visits to domains flagged for UI spoofing or credential harvesting through DNS and web filtering logs

How to Mitigate CVE-2026-87583

Immediate Actions Required

Update Google Chrome on Android to version 153.0.8010.36 or later through the Google Play Store
Push mandatory Chrome updates to managed Android devices via MDM policy
Communicate to users that legitimate Chrome password prompts appear as native UI, not embedded within page content

Patch Information

Google addressed this issue in the Chrome Stable channel update referenced in the Google Chrome Stable Update. Users should install Chrome 153.0.8010.36 or later on Android. Additional technical context is available in the Chromium Issue Tracker #533116484.

Workarounds

Disable Chrome's password autofill on Android until the browser is updated to a patched version
Restrict browsing to trusted sites through enterprise web filtering while patch deployment is in progress
Train users to verify password prompts by dismissing the page and re-navigating to the login site directly

bash

# Verify installed Chrome version on a managed Android device via ADB
adb shell dumpsys package com.android.chrome | grep versionName

# Expected output should show versionName=153.0.8010.36 or later