CVE-2026-87655: Google Chrome Clickjacking Vulnerability

CVE-2026-87655 Overview

CVE-2026-87655 is a clickjacking vulnerability in the Downloads user interface of Google Chrome versions prior to 153.0.8010.36. A remote attacker can craft an HTML page that spoofs UI elements, deceiving users into interacting with hidden or misrepresented download controls. Exploitation requires user interaction and social engineering to be successful. Google classifies the Chromium security severity as Medium. The flaw is tracked under CWE-1021: Improper Restriction of Rendered UI Layers or Frames.

Critical Impact
Attackers can trick users into approving or interacting with Chrome download prompts they did not intend to click, potentially leading to unwanted file downloads or execution of attacker-controlled content.

Affected Products

Google Chrome versions prior to 153.0.8010.36 (Desktop Stable channel)
Chromium-based builds inheriting the same Downloads UI code path
All operating systems supported by the Chrome Desktop Stable channel

Discovery Timeline

2026-09-09 - CVE-2026-87655 published to NVD
2026-09-09 - Google Chrome Stable channel update released addressing the issue (Chrome Releases blog)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87655

Vulnerability Analysis

The vulnerability resides in how Chrome renders and layers the Downloads UI relative to attacker-controlled web content. An attacker-controlled page can overlay, reposition, or otherwise obscure legitimate Chrome UI elements associated with the Downloads component. When a user clicks what appears to be a benign element, the interaction is instead routed to a Chrome download control.

Because the attack targets user perception rather than a memory safety flaw, exploitation depends on convincing content design and social engineering. The confidentiality and availability impact is limited, but successful exploitation can drive users to accept unwanted file downloads. Additional technical context is tracked in Chromium Issue #514023309.

Root Cause

The root cause is insufficient isolation and framing protection around the Downloads UI, aligning with [CWE-1021]. Chrome's rendering pipeline permitted attacker content to visually align with or occlude trusted browser chrome, breaking the trust boundary between web content and browser-controlled interface elements.

Attack Vector

Exploitation is remote and network-based. An attacker hosts a crafted HTML page and lures a victim to visit it, typically via phishing or malicious advertising. The page uses overlays, transparent layers, or timing tricks to align a decoy element with a Chrome Downloads prompt. When the user clicks the decoy, the click is delivered to the underlying download control.

No verified public proof-of-concept has been released, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-87655

Indicators of Compromise

Unexpected file downloads appearing in user Chrome download history without corresponding user intent
Browsing telemetry showing visits to pages with dense overlay layers, transparent iframes, or heavy pointer-events manipulation immediately preceding a download event
Endpoint download of executable or script file types from low-reputation domains following an ad or redirect chain

Detection Strategies

Correlate browser process download events with the referring URL and the preceding page navigation to identify suspicious download provenance
Inspect Chrome version telemetry across the fleet to identify endpoints running builds earlier than 153.0.8010.36
Hunt for downloaded files that were written to disk without a subsequent Save dialog interaction time consistent with human behavior

Monitoring Recommendations

Enable and centralize browser telemetry, including download events, extension activity, and navigation history
Alert on downloads of high-risk file extensions (.exe, .msi, .js, .lnk, .iso) originating from newly registered or uncategorized domains
Track Chrome version distribution and generate alerts when hosts fall behind the current Stable channel release

How to Mitigate CVE-2026-87655

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints
Restart Chrome after the update to ensure the patched binary is loaded
Verify update rollout status across the fleet using enterprise management tooling or browser inventory reporting

Patch Information

Google addressed the flaw in the Chrome Stable channel release documented in the Chrome Releases advisory. Chromium-based browsers should incorporate the corresponding upstream fix. Confirm the deployed browser build is 153.0.8010.36 or newer by navigating to chrome://settings/help.

Workarounds

Deploy user awareness guidance covering clickjacking and unexpected download prompts
Restrict execution of downloaded files using application control policies until patching is complete
Configure enterprise policies to auto-update Chrome and disable delayed update deferrals

bash

# Verify Chrome version on Linux endpoints
google-chrome --version

# Enterprise policy example (JSON) to enforce auto-update on managed Chrome
# Place under the Chrome managed policies path for your OS
{
  "UpdateDefault": 1,
  "AutoUpdateCheckPeriodMinutes": 60,
  "TargetVersionPrefix": "153."
}