CVE-2026-87615: Race Condition

Q: What must an attacker do to exploit this issue?

The attacker must get a user to interact with a crafted HTML page; exploitation relies on social engineering and is remote.

Q: Which Chrome versions are affected?

Google Chrome versions prior to 153.0.8010.36 are affected.

Q: What is the practical impact of successful exploitation?

A successful attack can spoof UI elements in Chrome Payments, potentially misleading a user about what they are seeing or approving.

Published Sep 9, 2026

Updated

Race condition in Payments in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

Affected Software

1 affected component

Google Chrome<153.0.8010.36

Event History

Sep 9, 2026

CVE Published

via MITRE·12:09 AM

Data Sourced

via MITRE·12:09 AM

DescriptionWeakness

Frequently Asked Questions

What must an attacker do to exploit this issue?

The attacker must get a user to interact with a crafted HTML page; exploitation relies on social engineering and is remote.

Which Chrome versions are affected?

Google Chrome versions prior to 153.0.8010.36 are affected.

What is the practical impact of successful exploitation?

A successful attack can spoof UI elements in Chrome Payments, potentially misleading a user about what they are seeing or approving.