CVE-2026-87635: Google Chrome XSS Vulnerability

CVE-2026-87635 Overview

CVE-2026-87635 is a UI misrepresentation vulnerability in the Payments component of Google Chrome prior to version 153.0.8010.36. A remote attacker can spoof user interface elements by serving a crafted HTML page. The flaw is tracked under CWE-451: User Interface (UI) Misrepresentation of Critical Information and rated Medium severity by the Chromium project. Exploitation requires user interaction with an attacker-controlled page. The issue affects Chrome across supported desktop platforms and is resolved in the Stable channel update published by Google.

Critical Impact
An attacker can misrepresent payment-related UI elements in the browser, enabling social engineering attacks against users completing online transactions.

Affected Products

Google Chrome (Desktop) versions prior to 153.0.8010.36
Chromium-based browsers incorporating the vulnerable Payments component
Stable channel installations that have not received the security update

Discovery Timeline

2026-09-09 - CVE CVE-2026-87635 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87635

Vulnerability Analysis

The vulnerability resides in the Payments subsystem of Google Chrome. Chrome's Payments component renders payment sheets, method selectors, and confirmation prompts that users rely on to verify transaction details. When the browser fails to correctly render or isolate these UI elements, an attacker-controlled page can overlay, obscure, or imitate trusted browser chrome.

The attack requires a user to visit a crafted HTML page. Once loaded, the page can manipulate rendering behavior to display spoofed UI that appears to originate from the browser's trusted Payments interface. The result is user interface confusion that can mislead victims into approving payments or disclosing sensitive information.

Successful exploitation impacts confidentiality and availability at a limited scope. Integrity of the browser process is not directly compromised, but the integrity of user decisions based on the spoofed UI is undermined.

Root Cause

The root cause is improper enforcement of visual boundaries between web content and trusted browser UI within the Payments component. The condition maps to [CWE-451], where security-relevant information is presented in a way that a user cannot reliably distinguish authentic browser prompts from attacker-rendered content.

Attack Vector

The attack vector is remote and network-based. An attacker hosts a crafted HTML page and lures a victim to visit it through phishing, malvertising, or a compromised site. When the victim interacts with the page, the crafted content triggers the UI misrepresentation. No authentication is required, but user interaction is necessary. See the Chromium Issue Tracker entry for additional technical context.

Detection Methods for CVE-2026-87635

Indicators of Compromise

Browser telemetry showing Chrome versions below 153.0.8010.36 in the environment.
User reports of unexpected or duplicated payment prompts during checkout flows.
Web proxy logs referencing recently registered domains hosting payment-themed HTML pages.

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag builds older than 153.0.8010.36.
Correlate phishing report intake with URL categories associated with payment or e-commerce spoofing.
Monitor endpoint DNS and HTTP telemetry for lookalike domains impersonating payment providers.

Monitoring Recommendations

Enable centralized browser version reporting through enterprise management tooling.
Track Chrome update compliance against the fixed build and alert on stale installations.
Review user-submitted phishing samples for HTML payloads that render fake payment sheets.

How to Mitigate CVE-2026-87635

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints.
Force-restart Chrome after deployment to ensure the patched binaries load.
Communicate the risk to users who process payments through the browser and reinforce verification of payment prompts.

Patch Information

Google has released the fix in the Chrome Stable channel. Administrators should deploy build 153.0.8010.36 or newer as documented in the Google Chrome Stable Channel Update. Chromium-based browsers should apply the upstream fix once available from their vendors.

Workarounds

Restrict access to untrusted sites through enterprise web filtering until patching completes.
Disable or restrict the Payment Request API through browser enterprise policy where feasible.
Instruct users to complete high-value transactions only from known, bookmarked merchant sites.

bash

# Configuration example
# Verify installed Chrome version on Windows endpoints
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Verify installed Chrome version on Linux
google-chrome --version