CVE-2026-87465: Incorrect authorization in Google Chrome

CVE-2026-87465 is an authorization flaw in Google Chrome's Downloads feature that permits a remote attacker with control over the renderer process to spoof UI elements by delivering a crafted HTML page. This could mislead users by displaying deceptive interface components. The vulnerability affects Chrome versions prior to 153.0.8010.36. The Chromium security team rates this issue as medium severity. No detailed CVSS score or explicit patch information is provided in the vendor advisory, though a stable channel update announcement exists.

The vulnerability allows an attacker who has already compromised the renderer process to spoof UI elements, potentially misleading users. This could facilitate social engineering or phishing attacks within the browser context. There is no indication of direct code execution or privilege escalation beyond the renderer compromise. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html for current remediation guidance. Users should update to Chrome version 153.0.8010.36 or later once available. Until then, limiting renderer process compromise vectors reduces risk.