CVE-2026-87653 Overview
CVE-2026-87653 is a user interface (UI) misrepresentation vulnerability in the FullScreen component of Google Chrome on Windows. The flaw affects Chrome versions prior to 153.0.8010.36. A remote attacker can spoof UI elements by serving a crafted HTML page to a target user. Chromium classifies the security severity as Low, and the vulnerability is tracked under [CWE-451: User Interface (UI) Misrepresentation of Critical Information]. Exploitation requires user interaction, such as entering fullscreen mode on an attacker-controlled page. The primary risk is phishing and browser interface spoofing rather than direct code execution or data theft.
Critical Impact
Attackers can spoof browser UI elements during fullscreen mode, enabling convincing phishing pages that impersonate address bars, security indicators, or operating system dialogs.
Affected Products
- Google Chrome on Windows prior to 153.0.8010.36
- Chromium-based browsers sharing the vulnerable FullScreen code path
- Microsoft Windows platforms running affected Chrome builds
Discovery Timeline
- 2026-09-09 - CVE-2026-87653 published to the National Vulnerability Database (NVD)
- 2026-09-09 - Google publishes the Stable Channel Update for Desktop addressing the issue
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-87653
Vulnerability Analysis
The vulnerability resides in Chrome's FullScreen implementation on Windows. When a page enters fullscreen through the Fullscreen API, the browser hides native chrome elements such as the address bar and tab strip. Under specific conditions, an attacker-controlled page can render content that mimics these hidden browser elements. The result is a visually convincing replica of trusted browser UI drawn entirely by attacker-supplied HTML and CSS.
This class of flaw does not compromise memory safety or process isolation. Instead, it undermines the trust boundary between web content and browser chrome. Attackers can leverage the spoofed interface to harvest credentials, prompt fake security warnings, or trick users into installing malicious software delivered through subsequent workflows.
Root Cause
The root cause is improper visual separation between web-rendered content and native browser UI while the fullscreen state is active on Windows. The FullScreen component fails to consistently overlay authentic security indicators, allowing crafted HTML to occupy screen regions users associate with trusted browser controls. This maps to [CWE-451], where critical information is presented in a way that misleads the user.
Attack Vector
Exploitation requires a victim to visit an attacker-controlled or compromised web page and grant the fullscreen request. Once fullscreen is active, the page renders a fake address bar, HTTPS lock icon, or system prompt. The victim then interacts with the spoofed element, submitting credentials or approving actions they believe originate from Chrome or Windows. No authentication or elevated privileges are required on the target system.
See the Chromium Issue Tracker #40058710 for technical details on the underlying rendering behavior.
Detection Methods for CVE-2026-87653
Indicators of Compromise
- Browser telemetry showing repeated requestFullscreen() calls from newly registered or low-reputation domains
- User reports of credential prompts, security warnings, or OS dialogs appearing inside browser tabs
- Outbound HTTP POST requests carrying credentials to domains that recently served fullscreen content
Detection Strategies
- Inventory installed Chrome versions across Windows endpoints and flag any build below 153.0.8010.36
- Correlate proxy or DNS logs with threat intelligence for domains hosting phishing kits that abuse the Fullscreen API
- Hunt for HTML artifacts containing CSS that mimics Chrome's Omnibox or Windows system dialogs
Monitoring Recommendations
- Enable enterprise browser telemetry to capture fullscreen events and their originating origins
- Monitor endpoint identification and response (EDR) logs for user-initiated credential entry followed by suspicious outbound connections
- Track Chrome update compliance through management tooling and alert on stalled deployments
How to Mitigate CVE-2026-87653
Immediate Actions Required
- Update Google Chrome on all Windows endpoints to version 153.0.8010.36 or later
- Force restart of Chrome processes to ensure the patched binary is loaded into memory
- Communicate phishing awareness guidance to users, emphasizing verification of fullscreen prompts
Patch Information
Google released the fix in the Stable Channel Update for Desktop. Refer to the Google Chrome Stable Update advisory for release notes and rollout guidance. Enterprise administrators should validate that Chrome auto-update is enabled or push the patched version via Group Policy and management platforms.
Workarounds
- Disable the Fullscreen API through the FullscreenAllowed enterprise policy where fullscreen is not business-critical
- Restrict fullscreen permissions to an allowlist of trusted internal domains
- Instruct users to press the Escape key when unexpected fullscreen transitions occur and to verify the URL before entering credentials
# Example Chrome enterprise policy on Windows to disable Fullscreen API
# Registry path: HKLM\Software\Policies\Google\Chrome
reg add "HKLM\Software\Policies\Google\Chrome" /v FullscreenAllowed /t REG_DWORD /d 0 /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
