UI misrepresentation in UrlFormatting in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof… (CVE-2026-87567)
Source GCVE Database
Not known to be exploited.
Data as of 10/25/2026, 04:40:14 UTC
CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 9% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
What to do
AI-suggested
Users and administrators should monitor official Google Chrome security advisories for updates and apply any forthcoming patches promptly. Until a fix is available, caution is advised when clicking on suspicious links or domains that could exploit this UI misrepresentation.
Description
A UI misrepresentation vulnerability in the UrlFormatting component of Google Chrome versions prior to 153.0.8010.36 allows a remote attacker to spoof the address bar by using a crafted domain name. This vulnerability could be exploited through social engineering to deceive users about the actual URL they are visiting. The Chromium security team has rated this issue as medium severity. No CVSS score or patch information is currently available.
Impact
An attacker exploiting this vulnerability could deceive users by displaying a spoofed URL in the browser's address bar, potentially leading to phishing or other social engineering attacks. This could result in users divulging sensitive information or performing actions under false pretenses. However, the impact is limited to UI deception and does not indicate direct code execution or system compromise.
Weaknesses
- CWE-451User Interface (UI) Misrepresentation of Critical Information (opens in a new tab)
Class weaknessOWASP Top 10 A06:2025: Insecure Design (opens in a new tab)
The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.