CVE-2026-87502: Google Chrome vulnerability

Q: What must an attacker have to exploit this issue?

The attacker must already have compromised the Chrome renderer process and must use social engineering. Exploitation also requires a crafted HTML page to spoof UI elements while in fullscreen mode.

Q: Which Chrome versions are affected?

Google Chrome versions prior to 153.0.8010.36 are affected.

Q: Who is realistically exposed?

Exposure is limited to users who can be induced to interact with attacker-controlled crafted HTML after the attacker has compromised Chrome's renderer process. The described impact is UI spoofing in fullscreen mode.

Published Sep 9, 2026

Updated

Confused deputy in Fullscreen in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

Affected Software

1 affected component

Google Chrome<153.0.8010.36

Event History

Sep 9, 2026

CVE Published

via MITRE·12:10 AM

Data Sourced

via MITRE·12:10 AM

DescriptionWeakness

Frequently Asked Questions

What must an attacker have to exploit this issue?

The attacker must already have compromised the Chrome renderer process and must use social engineering. Exploitation also requires a crafted HTML page to spoof UI elements while in fullscreen mode.

Which Chrome versions are affected?

Google Chrome versions prior to 153.0.8010.36 are affected.

Who is realistically exposed?

Exposure is limited to users who can be induced to interact with attacker-controlled crafted HTML after the attacker has compromised Chrome's renderer process. The described impact is UI spoofing in fullscreen mode.