Improper input validation in Interstitials in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML… (CVE-2026-87599)
Source GCVE Database
Not known to be exploited · fixed in 153.0.8010.36 : update affected systems when convenient.
Data as of 10/25/2026, 04:40:14 UTC
CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 13% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 153.0.8010.36
What to do
AI-suggested
A fix is available in Google Chrome version 153.0.8010.36. Users and administrators should update to this version or later to remediate the vulnerability. Since this is a client-side browser issue, applying the official update is the recommended mitigation.
Description
A vulnerability in Google Chrome prior to version 153.0.8010.36 allows remote attackers to spoof user interface elements by exploiting improper input validation in interstitial pages. This flaw could enable attackers to craft HTML pages that mislead users by displaying deceptive UI components. The issue is classified with medium severity by Chromium security.
Impact
The vulnerability could allow attackers to spoof UI elements in Chrome interstitials, potentially deceiving users into trusting malicious content or ignoring security warnings. This could reduce the effectiveness of security interstitials designed to protect users from harmful sites or content. However, no active exploitation has been reported.
Weaknesses
- CWE-20Improper Input Validation (opens in a new tab)
Class weaknessLikelihood of exploit: HighCWE Top 25 (2025): #18OWASP Top 10 A05:2025: Injection (opens in a new tab)
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
MITRE discourages mapping vulnerabilities to this broad entry; the root cause is usually a more specific weakness.