CVE-2026-87432: Google Chrome vulnerability

Q: What does an attacker need in order to exploit this issue?

The attacker must already have compromised the Chrome renderer process and then use a crafted HTML page to spoof UI elements. The provided information does not indicate that this vulnerability alone provides renderer-process compromise.

Q: Which Chrome versions should be remediated?

Google Chrome versions prior to 153.0.8010.36 are affected. Update Chrome to 153.0.8010.36 or later.

Q: What is the practical impact after exploitation?

A remote attacker with renderer-process compromise can spoof Chrome UI elements through crafted HTML content. This could make attacker-controlled page content appear as trusted browser interface elements.

Published Sep 9, 2026

Updated

Incorrect authorization in Navigation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

Affected Software

1 affected component

Google Chrome<153.0.8010.36

Event History

Sep 9, 2026

CVE Published

via MITRE·12:09 AM

Data Sourced

via MITRE·12:09 AM

DescriptionWeakness

Frequently Asked Questions

What does an attacker need in order to exploit this issue?

The attacker must already have compromised the Chrome renderer process and then use a crafted HTML page to spoof UI elements. The provided information does not indicate that this vulnerability alone provides renderer-process compromise.

Which Chrome versions should be remediated?

Google Chrome versions prior to 153.0.8010.36 are affected. Update Chrome to 153.0.8010.36 or later.

What is the practical impact after exploitation?

A remote attacker with renderer-process compromise can spoof Chrome UI elements through crafted HTML content. This could make attacker-controlled page content appear as trusted browser interface elements.