CVE-2026-87567: Google Chrome vulnerability

Q: What does an attacker need to exploit this issue?

The attacker needs to use a crafted domain name and rely on social engineering to persuade a victim to interact with the spoofed address-bar presentation.

Q: Which Chrome versions are affected?

Google Chrome versions prior to 153.0.8010.36 are affected.

Q: What is the recommended remediation?

Update Google Chrome to version 153.0.8010.36 or later.

Published Sep 9, 2026

Updated

UI misrepresentation in UrlFormatting in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof address bar via a crafted domain name. (Chromium security severity: Medium)

Affected Software

1 affected component

Google Chrome<153.0.8010.36

Event History

Sep 9, 2026

CVE Published

via MITRE·12:09 AM

Data Sourced

via MITRE·12:09 AM

DescriptionWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

The attacker needs to use a crafted domain name and rely on social engineering to persuade a victim to interact with the spoofed address-bar presentation.

Which Chrome versions are affected?

Google Chrome versions prior to 153.0.8010.36 are affected.

What is the recommended remediation?

Update Google Chrome to version 153.0.8010.36 or later.