Confused deputy in Fullscreen in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and… (CVE-2026-87502)
Source GCVE Database
Not known to be exploited · fixed in 153.0.8010.36 : update affected systems when convenient.
Data as of 10/25/2026, 04:40:14 UTC
CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 11% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 153.0.8010.36
What to do
AI-suggested
A fix is available in Google Chrome version 153.0.8010.36 and later. Users and administrators should update to this version or newer to remediate the vulnerability. No additional mitigation guidance is provided by the vendor. Since this is not a cloud service, remediation depends on applying the browser update.
Description
A confused deputy vulnerability exists in the fullscreen feature of Google Chrome versions prior to 153.0.8010.36. This flaw allows a remote attacker who has compromised the renderer process to use social engineering to spoof UI elements via a crafted HTML page. The Chromium project has assigned this issue a low security severity rating.
Impact
The impact is limited to scenarios where the attacker has already compromised the renderer process and can trick users through UI spoofing in fullscreen mode. This could lead to user deception but does not directly escalate privileges or compromise the browser beyond the renderer process. The Chromium project rates this vulnerability as low severity.
Weaknesses
- CWE-441Unintended Proxy or Intermediary ('Confused Deputy') (opens in a new tab)
Class weaknessOWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.