CVE-2026-87507

Analyzed Analyzed - Analysis Complete

Chrome UI Spoofing in Downloads Prior to 153.0.8010.36

Publication date: 2026-09-09

Last updated on: 2026-09-10

Assigner: Chrome

Description

UI misrepresentation in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-10

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-87507

EUVD

EUVD-2026-74365

Affected Vendors & Products

Vendor	Product	Version / Range
google	chrome	to 153.0.8010.36 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-451	The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.

Attack-Flow Graph

Executive Summary

This vulnerability involves a UI misrepresentation in Google Chrome's Downloads feature. It allows a remote attacker to trick users into believing false UI elements via a crafted HTML page, potentially leading to social engineering attacks.

Detection Guidance

Detection involves checking the Chrome version installed. Compare it against version 153.0.8010.36. If your version is older, the system is vulnerable. Use commands like 'google-chrome --version' or check via browser settings.

Impact Analysis

This vulnerability could trick you into downloading malicious files or sharing sensitive information by presenting fake UI elements. It relies on social engineering, so user interaction is required for exploitation.

Compliance Impact

This vulnerability involves UI misrepresentation in Google Chrome's Downloads feature, which could be exploited through social engineering to deceive users. While it may not directly violate GDPR or HIPAA, it could contribute to compliance risks by enabling phishing attacks that trick users into downloading malicious files, potentially leading to unauthorized data access or breaches.

Mitigation Strategies

Update Google Chrome to version 153.0.8010.36 or later immediately. Disable automatic downloads from untrusted sources and enable safe browsing features. Avoid clicking suspicious links or downloading files from unknown origins.

Hi! I’m here to help you understand CVE-2026-87507. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70