The vulnerability identified as CVE-2026-87502 involves a confused deputy condition in the fullscreen functionality of Google Chrome before version 153.0.8010.36. An attacker who has already compromised the renderer process can exploit this flaw by crafting an HTML page that uses social engineering techniques to spoof user interface elements. This could potentially mislead users interacting with the browser in fullscreen mode. The issue is categorized under CWE-441 (Incorrect Control of a Resource Through its Lifetime). No CVSS score is provided, and no known exploits are reported in the wild.

The impact is limited to scenarios where the attacker has already compromised the renderer process and can trick users through UI spoofing in fullscreen mode. This could lead to user deception but does not directly escalate privileges or compromise the browser beyond the renderer process. The Chromium project rates this vulnerability as low severity.

A fix is available in Google Chrome version 153.0.8010.36 and later. Users and administrators should update to this version or newer to remediate the vulnerability. No additional mitigation guidance is provided by the vendor. Since this is not a cloud service, remediation depends on applying the browser update.