UI misrepresentation in Passwords in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted… (CVE-2026-87583)
Source GCVE Database
Not known to be exploited · fixed in 153.0.8010.36 : update affected systems when convenient.
Data as of 10/25/2026, 04:40:14 UTC
CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 16% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 153.0.8010.36
What to do
AI-suggested
Users and administrators should monitor official Google Chrome security advisories for updates and apply the update to version 153.0.8010.36 or later once available to remediate this issue.
Description
A UI misrepresentation vulnerability exists in the Passwords feature of Google Chrome on Android versions prior to 153.0.8010.36. This flaw allows a remote attacker to spoof UI elements by crafting a malicious HTML page. The issue has been assigned CVE-2026-87583 and is classified with low severity by the Chromium security team. There is no CVSS score available for this vulnerability. No known exploits are reported in the wild. No patch or remediation details are provided in the available data.
Impact
The impact is limited to UI spoofing within the Passwords feature on Chrome for Android, which may lead to user confusion or deception but does not indicate direct code execution or data compromise. The Chromium team rates this vulnerability as low severity. There are no known active exploits in the wild.
Summary
CVE-2026-87583 is a vulnerability in Google Chrome on Android where the Passwords UI can be misrepresented. Specifically, a remote attacker can craft a malicious HTML page that spoofs UI elements within the Passwords interface, potentially misleading users. This vulnerability is identified as CWE-451 (Incorrect Expression of User Interface). The issue affects versions of Chrome on Android prior to 153.0.8010.36. No detailed patch information or vendor advisory is provided in the input data.
Weaknesses
- CWE-451User Interface (UI) Misrepresentation of Critical Information (opens in a new tab)
Class weaknessOWASP Top 10 A06:2025: Insecure Design (opens in a new tab)
The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.