CVE-2026-87562 in Chrome
Summary
by MITRE • 09/09/2026
Incorrect reference resolution in Accessibility in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to potentially spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as an incorrect reference resolution within the Accessibility component of Google Chrome on macOS represents a significant class of user interface deception risks. This flaw, which was addressed in version 153.0.8010.36 and earlier versions prior to this patch, stems from improper handling of object references during the rendering or processing of accessibility tree structures. In web browsers, the accessibility API serves as a critical bridge between the visual representation of web content and assistive technologies such as screen readers, voice control software, and other input methods designed for users with disabilities. When an application fails to correctly resolve these internal references, it creates a discrepancy between what is visually presented on the screen and what is exposed through accessibility APIs or how the operating system interprets user interactions with those elements.
From a technical perspective, this issue allows a remote attacker to manipulate the context in which UI elements are perceived by both automated tools and human users relying on assistive technologies. By crafting a specific HTML page that exploits this reference resolution error, an adversary can cause the browser to associate incorrect metadata or properties with interactive elements such as buttons, links, or form fields. This misalignment enables the attacker to spoof UI elements, effectively tricking accessibility software into reporting false information about the state or function of these components. For instance, a malicious link might be exposed by the accessibility API as a benign button that performs no action, while visually appearing and functioning differently, thereby confusing users who depend on accurate semantic descriptions for navigation.
The operational impact of this vulnerability is primarily centered around user interface spoofing and potential social engineering attacks facilitated through assistive technology channels. While traditional phishing often relies on visual deception visible to the naked eye, this flaw introduces a vector where deception occurs at the accessibility layer. Users with disabilities who rely heavily on screen readers or voice commands are particularly vulnerable because they may not have the same visual cues as sighted users to verify the legitimacy of an interface element. An attacker could exploit this by creating a scenario where a user believes they are interacting with a trusted, secure component when they are actually engaging with a malicious payload disguised through incorrect accessibility metadata. This undermines trust in the browser's ability to provide accurate information and can lead to unauthorized actions or data exfiltration if combined with other attack vectors that leverage misinterpreted commands.
This vulnerability aligns closely with CWE-829, which describes Inclusion of Functionality from Untrusted Control Sector, specifically regarding how untrusted input leads to incorrect reference resolution affecting system behavior. Furthermore, it relates to the ATT&CK technique T1078, Valid Accounts or System Configuration Manipulation in the context of deceiving security controls and user perception, although more directly it falls under UI Redressing concepts where the interface is manipulated to mislead users about their actions. The severity is classified as Medium by Chromium because while it does not typically allow for direct code execution or remote access on its own, it significantly degrades the integrity of the user experience and poses a substantial risk to accessibility-dependent populations who are often targeted due to potentially lower digital literacy regarding browser-specific exploits.
Mitigation strategies primarily involve ensuring that all software components are updated to versions where this reference resolution logic has been corrected. For organizations deploying Google Chrome on macOS, it is imperative to enforce automatic updates or implement strict patch management policies to ensure users remain on version 153.0.8010.36 or later. Additionally, developers should audit their use of accessibility APIs and ensure that dynamic content changes are properly reflected in the accessibility tree without introducing ambiguous references. Security awareness training for administrators should highlight the importance of maintaining up-to-date browser versions to prevent exploitation of such logic errors that compromise UI integrity and user trust.