CVE-2026-87502 in Chrome
Summary
by MITRE • 09/09/2026
Confused deputy in Fullscreen in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as a confused deputy issue within Google Chrome prior to version 153.0.8010.36 represents a significant breach in the browser's trust boundary, specifically concerning user interface spoofing during fullscreen mode. This flaw allows an attacker who has already achieved code execution within the renderer process to escalate their impact by manipulating how the browser presents information to the end-user. The core of this vulnerability lies in the failure of the application to properly distinguish between legitimate UI elements generated by the browser itself and those injected or spoofed by malicious content running under lower privileges. By leveraging social engineering techniques, an attacker can craft a specific HTML page that tricks the user into interacting with fake interface components while believing they are communicating with a trusted entity, such as a banking portal or corporate login screen.
From a technical perspective, this issue stems from insufficient validation of UI context when rendering content in fullscreen mode. In standard browsing contexts, Chrome employs various sandboxing mechanisms and origin checks to prevent malicious scripts from accessing sensitive browser functions or mimicking system dialogs. However, the transition to fullscreen can alter how certain permissions are handled or displayed, creating a window where an attacker with renderer-level access can overlay deceptive elements that appear authentic. This confusion allows the compromised process to act as a deputy for the user without proper authorization checks, effectively deceiving the victim into providing credentials or performing unauthorized actions because they perceive the interaction as legitimate and secure.
The operational impact of this vulnerability is primarily centered around credential theft and session hijacking through sophisticated phishing attacks. Since the attacker has already compromised the renderer process, often via a drive-by download or exploit chain originating from another site, this flaw amplifies their ability to steal high-value data. By spoofing login prompts, two-factor authentication codes, or confirmation dialogs within fullscreen mode, the attack becomes significantly more convincing than traditional phishing pages that lack browser-level integration. Users are less likely to suspect foul play when the interface appears native and seamless, leading to a higher success rate for social engineering campaigns targeting sensitive information such as passwords, financial details, or corporate secrets.
This vulnerability aligns with CWE-275, which describes incorrect handling of permissions where an application does not properly enforce security policies regarding user actions. Furthermore, it maps directly to the MITRE ATT&CK technique T1089, Disabling Security Tools, and more specifically T1621, Multi-Factor Authentication Interception, as well as T1566.002, Spearphishing Link, depending on the delivery method. The attacker leverages the browser's own UI framework to bypass user awareness mechanisms that typically detect non-standard domains or insecure connections. This makes it a critical concern for organizations relying on Chrome for secure web access, particularly in environments where fullscreen applications are used for kiosk modes or dedicated task-based browsing.
Mitigation strategies must focus on both immediate patching and long-term architectural improvements. The primary defense is to update Google Chrome to version 153.0.8010.36 or later, which addresses the flawed UI context validation logic. For environments where automatic updates are not feasible, administrators should enforce strict content security policies that restrict fullscreen privileges for untrusted origins and monitor renderer process behavior for anomalies indicative of UI manipulation. Additionally, user education remains vital; training personnel to verify URL bars even in fullscreen modes and to be skeptical of unexpected prompts can reduce the effectiveness of such social engineering attacks. Future browser developments should prioritize stricter separation between native chrome UI elements and web-rendered content to prevent any possibility of confusion deputy scenarios where malicious scripts masquerade as system-level interfaces.