CVE-2026-87615: Google Chrome Race Condition Vulnerability

CVE-2026-87615 Overview

CVE-2026-87615 is a race condition vulnerability in the Payments component of Google Chrome prior to version 153.0.8010.36. A remote attacker can exploit the flaw by serving a crafted HTML page that leverages social engineering to spoof user interface elements. The Chromium project rates this issue as Medium severity. Successful exploitation requires user interaction, such as visiting a malicious page and interacting with payment prompts. The vulnerability is tracked under CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization).

Critical Impact
Attackers can spoof payment-related UI elements to mislead users, potentially facilitating credential capture or fraudulent transaction confirmation.

Affected Products

Google Chrome versions prior to 153.0.8010.36 (Desktop)
Chromium-based browsers inheriting the vulnerable Payments component
Windows, macOS, and Linux Chrome Stable channel builds

Discovery Timeline

2026-09-09 - CVE-2026-87615 published to the National Vulnerability Database (NVD)
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87615

Vulnerability Analysis

The vulnerability resides in the Payments component of Chrome, which handles the Payment Request API and the associated payment UI flows. A race condition allows two concurrent operations to interact with shared UI state before proper synchronization completes. During this narrow window, a crafted HTML page can render or manipulate content that appears to be part of a trusted browser payment prompt. The attack requires user interaction, meaning the victim must load the attacker-controlled page and engage with the payment flow. Confidentiality and availability are affected at a limited scope, while integrity is not directly impacted per the CVSS vector. The flaw is a UI spoofing issue rather than a memory corruption or code execution primitive.

Root Cause

The root cause is improper synchronization between rendering and state updates in the Payments UI pipeline. When two threads or asynchronous tasks operate on shared payment presentation state without atomicity guarantees, an attacker-controlled page can interleave DOM manipulation with the browser's native prompt rendering. This category of defect is classified under CWE-362.

Attack Vector

An attacker hosts a crafted HTML page and directs a victim to visit it through phishing, malvertising, or another social engineering technique. The page invokes the Payment Request API and times DOM updates to coincide with the vulnerable rendering window. The victim perceives spoofed UI elements as legitimate browser chrome, which can trick them into approving a transaction, entering payment data, or trusting attacker-controlled content overlaid on the payment surface.

No public proof-of-concept exploit is available at the time of publication. Technical details are referenced in the Chromium Issue Tracker Entry and the Chrome Desktop Update Announcement.

Detection Methods for CVE-2026-87615

Indicators of Compromise

Chrome browser instances still reporting versions earlier than 153.0.8010.36 in endpoint inventory data
Web proxy or DNS telemetry showing user navigation to unfamiliar domains invoking the Payment Request API
User reports of unexpected or duplicated payment prompts appearing during web browsing sessions

Detection Strategies

Query endpoint inventory for outdated Chrome installations and correlate against the fixed build 153.0.8010.36
Inspect browser telemetry and console logs for anomalous PaymentRequest invocations from low-reputation domains
Monitor phishing and malvertising campaigns targeting payment workflows, using URL reputation and category feeds

Monitoring Recommendations

Enforce browser version reporting through management tooling and alert on hosts running unpatched Chrome builds
Use web filtering to block known malicious domains and newly registered domains hosting payment-themed lures
Collect and analyze user-reported spoofing or phishing incidents through a centralized reporting workflow

How to Mitigate CVE-2026-87615

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints across Windows, macOS, and Linux
Restart Chrome after the update to ensure the patched Payments component is loaded into all browser processes
Communicate awareness guidance to users about verifying payment prompts and avoiding untrusted sites

Patch Information

Google released the fix in the Stable channel update announced in the Chrome Desktop Update Announcement. Administrators should confirm all endpoints are running 153.0.8010.36 or later. Additional context is available in the Chromium Issue Tracker Entry.

Workarounds

Restrict use of the Payment Request API through enterprise browser policies where business use cases do not require it
Deploy URL filtering to block access to untrusted sites that could host crafted HTML payloads targeting this flaw
Train users to close unexpected payment prompts and validate transactions through the merchant's official site directly

bash

# Verify Chrome version on Linux and macOS endpoints
google-chrome --version

# On Windows, query the installed version via PowerShell
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# Expected output: 153.0.8010.36 or later