CVE-2026-87462 in Chrome
Summary
by MITRE • 09/09/2026
UI misrepresentation in FedCM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified within the Federated Identity Management system, commonly known as FedCM, in Google Chrome prior to version 153.0.8010.36 represents a significant risk related to user interface deception and trust manipulation. This flaw allows for the misrepresentation of critical UI elements during the authentication flow, effectively enabling an attacker to create a deceptive experience that mimics legitimate identity provider interfaces or browser prompts. By leveraging social engineering techniques alongside this technical exploit, a remote attacker can trick users into interacting with spoofed dialogs or buttons, thereby undermining the fundamental security guarantees provided by the federated login process. The severity of this issue is classified as Medium within the Chromium security framework, reflecting its potential to facilitate phishing attacks and credential harvesting through visual deception rather than direct code execution or memory corruption.
At a technical level, the flaw stems from improper handling of UI rendering contexts during the FedCM handshake. When a website initiates an identity assertion request, Chrome is responsible for presenting a standardized prompt that clearly indicates which site is requesting access to user information and which identity provider will handle the authentication. The vulnerability allows crafted HTML pages to manipulate these visual cues, potentially hiding or altering text, icons, or layout structures in a way that obscures the true origin of the request. This misrepresentation breaks the chain of trust between the browser, the relying party website, and the user. An attacker can construct a malicious page that displays a fake consent dialog resembling a legitimate Google sign-in prompt, thereby convincing the victim to authorize access or share sensitive profile data with an unauthorized third-party service.
The operational impact of this vulnerability is primarily centered around identity theft and account compromise through sophisticated phishing campaigns. Since FedCM is designed to streamline authentication across multiple services while maintaining privacy boundaries, any erosion of user confidence in these prompts can lead to widespread credential leakage. Users who are deceived by spoofed UI elements may inadvertently grant permissions that allow attackers to access personal information, email addresses, or even session tokens associated with their Google accounts. This not only compromises individual user security but also facilitates broader attacks such as business email compromise or unauthorized access to enterprise resources if the compromised account is linked to organizational identity systems. The reliance on visual cues for trust makes this vulnerability particularly dangerous in contexts where users are already under pressure or distraction, increasing the likelihood of successful exploitation via social engineering.
From a classification perspective, this issue aligns with CWE-201: Insertion of Sensitive Information into Sent Data and CWE-437: Incorrect Behavior Order, as it involves the improper presentation of security-critical information to the user. In terms of offensive tactics, it maps directly to MITRE ATT&CK technique T1566.002: Spearphishing Link, specifically when used in conjunction with UI redressing or spoofing techniques like T1434: Internal Spearphishing if deployed within an organization, though more broadly it fits under the general category of Phishing (T1598) and Social Engineering (T1621). The attack vector is remote, requiring no prior access to the victim's system, but relies heavily on the psychological manipulation of the user through deceptive visual interfaces.
Mitigation for this vulnerability requires immediate updates to Google Chrome versions 153.0.8010.36 or later, where these UI rendering inconsistencies have been addressed by enforcing stricter validation and isolation of FedCM prompt elements. Organizations should ensure that endpoint management policies enforce automatic browser updates to minimize the window of exposure. Additionally, security awareness training is critical in this context; users must be educated to scrutinize the domain names displayed in authentication prompts rather than relying solely on visual design cues which can be easily forged. Implementing multi-factor authentication adds a layer of defense against credential theft resulting from such social engineering attacks, although it does not prevent the initial deception. Monitoring for unusual login patterns or consent grants from unfamiliar applications can also help detect potential compromises stemming from this vulnerability before significant damage occurs.