Race condition in Payments in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof UI elements via… (CVE-2026-87615)
Source GCVE Database
Not known to be exploited · fixed in 153.0.8010.36 : update affected systems when convenient.
Data as of 10/25/2026, 04:40:14 UTC
CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 8% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 153.0.8010.36
What to do
AI-suggested
A fix is available in Google Chrome version 153.0.8010.36. Users and administrators should update to this version or later to remediate the vulnerability. Since this is not a cloud service, remediation depends on applying the browser update. No additional mitigation steps are specified.
Description
A race condition vulnerability exists in the Payments component of Google Chrome versions prior to 153.0.8010.36. This flaw allows a remote attacker, using social engineering techniques and a crafted HTML page, to spoof user interface elements. The Chromium security team has rated this vulnerability as medium severity. No CVSS score or known exploits in the wild have been reported. No explicit affected versions were provided beyond the version fixed in 153.0.8010.36.
Impact
An attacker could remotely cause the browser to display spoofed UI elements within the Payments feature, potentially deceiving users into performing unintended actions. The impact is limited to UI spoofing and does not indicate direct code execution or data compromise. The severity is assessed as medium by the Chromium security team.
Summary
CVE-2026-87615 is a race condition vulnerability in the Payments feature of Google Chrome before version 153.0.8010.36. The flaw enables a remote attacker to manipulate UI elements by exploiting a timing issue, potentially misleading users through spoofed interface components. The attack requires social engineering and a crafted HTML page to trigger the issue. The vulnerability is categorized under CWE-362 (Race Condition). There is no CVSS score available, and no known active exploitation has been reported.
Weaknesses
- CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') (opens in a new tab)
Class weaknessLikelihood of exploit: MediumOWASP Top 10 A06:2025: Insecure Design (opens in a new tab)
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.