Improper input validation in Chromium in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to… (CVE-2026-87568)
Source GCVE Database
Not known to be exploited.
Data as of 10/24/2026, 22:16:05 UTC
CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 9% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
What to do
AI-suggested
Since the vulnerability affects versions prior to 153.0.8010.36, updating to version 153.0.8010.36 or later is likely recommended once official guidance is available.
Description
An improper input validation vulnerability exists in Chromium used by Google Chrome versions prior to 153.0.8010.36. This flaw allows a remote attacker who has already compromised the renderer process to spoof user interface elements by sending crafted network traffic. The vulnerability is classified with low severity by Chromium security. No CVSS score or known exploits in the wild have been reported. No explicit patch information is provided in the source data.
Impact
The vulnerability could allow a remote attacker with control over the renderer process to spoof UI elements, potentially misleading users. However, the impact is considered low severity by Chromium security, and no active exploitation has been reported.
Summary
CVE-2026-87568 describes an improper input validation vulnerability in Chromium within Google Chrome before version 153.0.8010.36. The issue enables a remote attacker, who has compromised the renderer process, to spoof UI elements through crafted network traffic. The vulnerability is associated with CWE-20 (Improper Input Validation). There is no CVSS score or detailed vendor advisory available in the provided data, and no known exploits have been reported.
Weaknesses
- CWE-20Improper Input Validation (opens in a new tab)
Class weaknessLikelihood of exploit: HighCWE Top 25 (2025): #18OWASP Top 10 A05:2025: Injection (opens in a new tab)
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
MITRE discourages mapping vulnerabilities to this broad entry; the root cause is usually a more specific weakness.