CVE-2026-87462: UI misrepresentation in Google Chrome

CVE-2026-87462 describes a UI misrepresentation vulnerability in the Federated Credential Management (FedCM) feature of Google Chrome versions before 153.0.8010.36. An attacker can craft a malicious HTML page that spoofs UI elements, potentially misleading users through social engineering. This vulnerability does not have a CVSS score and no known exploits are reported in the wild. The issue was publicly disclosed on September 9, 2026, and Google has published a stable channel update addressing this flaw.

The vulnerability allows remote attackers to deceive users by spoofing UI elements in the FedCM feature, which could lead to social engineering attacks. This may cause users to unknowingly interact with fraudulent UI components, potentially compromising security decisions. However, there is no indication of direct code execution or data breach from this vulnerability alone.

Google has released an update in Chrome version 153.0.8010.36 that addresses this vulnerability. Users and administrators should update to this version or later to mitigate the risk. Since this is a client-side browser issue, applying the official Chrome update is the recommended remediation. Patch status is confirmed by the vendor advisory at https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html.