CVE-2026-87472: Improper input validation in Google Chrome

This vulnerability in Google Chrome's FedCM feature arises from improper input validation. An attacker with control over the renderer process can craft HTML content that spoofs UI elements, potentially deceiving users. The issue affects Chrome versions before 153.0.8010.36. The Chromium security team has rated this vulnerability as medium severity. No detailed CVSS score or explicit remediation level is provided in the available data. The vendor advisory is referenced but does not specify patch status.

The impact is limited to UI spoofing by an attacker who already has compromised the renderer process. This could lead to user deception but requires prior compromise of the renderer, limiting the scope of exploitation. The severity is assessed as medium by Chromium security.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html for current remediation guidance. Until official confirmation, users should update Chrome to version 153.0.8010.36 or later once available, as this version is indicated as the fixed version. No additional vendor-provided mitigations are stated.