UI misrepresentation in FullScreen in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a… (CVE-2026-87653)
Source GCVE Database
Not known to be exploited.
Data as of 10/25/2026, 04:40:14 UTC
CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 16% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
What to do
AI-suggested
Until a fix is available, cautious use of FullScreen mode and avoiding untrusted web content may reduce risk.
Description
A UI misrepresentation vulnerability exists in the FullScreen mode of Google Chrome on Windows versions prior to 153.0.8010.36. This flaw allows a remote attacker to spoof UI elements by crafting a malicious HTML page. The issue is classified with low severity by Chromium security. No known exploits are reported in the wild, and no patch information is provided in the source data.
Impact
The vulnerability allows remote attackers to spoof UI elements in FullScreen mode, which could potentially deceive users into interacting with fake interface components. However, the severity is rated low by Chromium security, indicating limited impact or exploitability. There are no known active exploits in the wild.
Weaknesses
- CWE-451User Interface (UI) Misrepresentation of Critical Information (opens in a new tab)
Class weaknessOWASP Top 10 A06:2025: Insecure Design (opens in a new tab)
The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.