UI misrepresentation in UI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof UI elements via… (CVE-2026-87559)
Source GCVE Database
Not known to be exploited · fixed in 153.0.8010.36 : update affected systems when convenient.
Data as of 10/25/2026, 04:40:14 UTC
CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 12% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 153.0.8010.36
What to do
AI-suggested
A fix is available in Google Chrome version 153.0.8010.36 and later. Users and administrators should update to this version or newer to remediate the vulnerability. Since this is not a cloud service, patching the client software is required. No alternative mitigations are indicated.
Description
A UI misrepresentation vulnerability exists in Google Chrome versions prior to 153.0.8010.36. This flaw allows a remote attacker to use social engineering techniques to spoof UI elements by crafting malicious HTML pages. The vulnerability is classified with medium severity by Chromium security. No CVSS score or exploit in the wild is currently reported.
Impact
The vulnerability could allow attackers to deceive users by displaying spoofed UI elements, potentially leading to phishing or other social engineering attacks. However, there is no evidence of active exploitation in the wild. The impact is limited to UI misrepresentation without direct code execution or privilege escalation reported.
Summary
CVE-2026-87559 is a vulnerability in Google Chrome before version 153.0.8010.36 where an attacker can create a crafted HTML page that causes the browser to misrepresent UI elements. This UI spoofing can be leveraged through social engineering to deceive users. The issue is categorized under CWE-451 (User Interface Misrepresentation). There is no detailed technical exploit information or CVSS score available.
Weaknesses
- CWE-451User Interface (UI) Misrepresentation of Critical Information (opens in a new tab)
Class weaknessOWASP Top 10 A06:2025: Insecure Design (opens in a new tab)
The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.