CVE-2026-87599: Google Chrome XSS Vulnerability

CVE-2026-87599 Overview

CVE-2026-87599 is an improper input validation vulnerability in the Interstitials component of Google Chrome. The flaw affects Chrome versions prior to 153.0.8010.36. A remote attacker can spoof user interface elements by serving a crafted HTML page to a victim. Google classifies the Chromium security severity as Medium.

The vulnerability maps to [CWE-20: Improper Input Validation]. Exploitation requires user interaction, such as visiting an attacker-controlled page. Successful spoofing of interstitial warnings can trick users into trusting malicious content or dismissing legitimate security warnings.

Critical Impact
Attackers can spoof interstitial security warnings to mislead users into interacting with malicious pages, undermining a key browser trust boundary.

Affected Products

Google Chrome (Desktop) versions prior to 153.0.8010.36
Chromium-based browsers that incorporate the vulnerable Interstitials code
All operating systems running affected Chrome desktop builds

Discovery Timeline

2026-09-09 - CVE-2026-87599 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87599

Vulnerability Analysis

The vulnerability resides in the Chrome Interstitials subsystem, which renders full-page security warnings such as Safe Browsing malware alerts, certificate errors, and phishing notifications. Interstitials act as a trust boundary between the browser chrome and untrusted web content. Improper input validation in this component allows a crafted HTML page to influence how interstitial UI elements are rendered or interpreted.

The issue is tracked in Chromium Issue #513702096 and addressed in the Google Chrome Desktop stable channel update. The EPSS score is 0.175% at the time of publication, indicating low observed exploitation likelihood.

Root Cause

The root cause is inadequate validation of attacker-controlled input rendered within or adjacent to interstitial pages. When the Interstitials component processes data from an untrusted document, it fails to normalize or restrict content that can influence displayed UI. This gap lets crafted HTML alter how the warning appears to the user.

Attack Vector

Exploitation requires a victim to load an attacker-controlled HTML page in an unpatched Chrome build. The attacker crafts markup that manipulates or overlays interstitial UI elements, such as warning banners, buttons, or origin indicators. The result is a spoofed warning that either hides a legitimate threat notice or fabricates a benign-looking prompt.

The attack does not grant code execution or data theft on its own. Instead, it serves as a social engineering primitive that enables downstream attacks such as credential phishing or malware delivery through counterfeit trust cues.

No public proof-of-concept, exploit code, or CISA KEV listing exists for this CVE at publication time.

Detection Methods for CVE-2026-87599

Indicators of Compromise

Chrome desktop clients reporting versions earlier than 153.0.8010.36 in browser telemetry or user-agent inventories
Web traffic to pages containing HTML designed to overlay or replicate Chrome interstitial UI, particularly Safe Browsing or certificate warning layouts
User reports of unusual security warnings that dismiss without expected browser behavior

Detection Strategies

Inventory endpoint browser versions and flag hosts running Chrome builds below 153.0.8010.36
Inspect proxy and DNS logs for domains hosting content that references interstitial CSS classes, images, or DOM structures used by Chromium
Correlate phishing report submissions with the affected Chrome versions to surface potential spoofing attempts

Monitoring Recommendations

Track Chrome update compliance through endpoint management platforms and alert on stalled deployments
Monitor URL reputation feeds for newly registered domains impersonating Chrome warning pages
Review Safe Browsing bypass patterns and phishing click-through metrics for anomalies after user interaction with warnings

How to Mitigate CVE-2026-87599

Immediate Actions Required

Update Google Chrome desktop to version 153.0.8010.36 or later on all managed endpoints
Push the update through enterprise policy channels such as Chrome Browser Cloud Management or group policy to enforce restart
Verify Chromium-based third-party browsers have absorbed the upstream fix before considering the issue closed

Patch Information

Google released the fix in the Chrome stable channel update documented at Google Chrome Desktop Update. The patched version is 153.0.8010.36. Technical details are tracked in Chromium Issue #513702096.

Workarounds

Enforce Safe Browsing Enhanced Protection through enterprise policy to increase the likelihood that malicious hosting infrastructure is blocked upstream
Deliver user awareness guidance on validating URL bar contents rather than trusting in-page warning UI
Restrict access to untrusted external sites for high-risk user groups until patch deployment is confirmed

bash

# Configuration example: verify installed Chrome version on Windows endpoints
reg query "HKLM\Software\Google\Chrome\BLBeacon" /v version

# Linux / macOS
google-chrome --version