UI misrepresentation in Passwords in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer… (CVE-2026-87624)
Source GCVE Database
Not known to be exploited : monitor for a fix to affected systems.
Data as of 10/24/2026, 20:40:32 UTC
CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 12% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
GitHubchromium/chromiumpkg:github/chromium/chromiumOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
A fix is available in Google Chrome version 153.0.8010.36 and later. Users and administrators should update affected Chrome installations on Android to this version or newer to remediate the vulnerability. No additional mitigation guidance is provided or necessary.
Description
A UI misrepresentation vulnerability exists in the Passwords component of Google Chrome on Android versions prior to 153.0.8010.36. This flaw allows a remote attacker who has compromised the renderer process to spoof UI elements by crafting a malicious HTML page. The vulnerability is classified with low severity by Chromium security. No CVSS score or known exploits in the wild have been reported.
Impact
The impact is limited to UI spoofing within the Passwords feature on affected Chrome versions on Android. This could cause users to be misled by falsified interface elements, but exploitation requires prior compromise of the renderer process. There are no reports of active exploitation in the wild.
Weaknesses
- CWE-451User Interface (UI) Misrepresentation of Critical Information (opens in a new tab)
Class weaknessOWASP Top 10 A06:2025: Insecure Design (opens in a new tab)
The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.