CVE-2026-87567 in Chrome
Summary
by MITRE • 09/09/2026
UI misrepresentation in UrlFormatting in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof address bar via a crafted domain name. (Chromium security severity: Medium)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as UI misrepresentation in the URL formatting logic of Google Chrome prior to version 153.0.8010.36 represents a significant class of attacks known as homograph or phishing-based spoofing. This flaw resides within the browser's address bar rendering engine, which is responsible for displaying web addresses to users in a human-readable format. The core technical issue involves an insufficient validation or normalization process when processing domain names that contain characters capable of visual deception. Specifically, attackers can craft URLs using Unicode characters from various scripts, such as Cyrillic or Greek, that visually resemble ASCII Latin letters but are technically distinct at the code point level. When a user interacts with such a crafted link, typically through social engineering tactics like clicking a malicious hyperlink in an email or on a compromised website, the browser displays a URL that appears legitimate and matches the target domain, while the actual underlying network request is directed to a different, attacker-controlled server. This discrepancy creates a false sense of security for the end-user, who believes they are interacting with a trusted entity based solely on the visual representation in the address bar.
From an operational impact perspective, this vulnerability facilitates sophisticated phishing campaigns that bypass traditional user vigilance mechanisms. Since modern browsers often display only the domain name and not every character in full detail, especially when URLs become long or contain subdomains, the subtle differences between similar-looking characters from different alphabets can go unnoticed by non-technical users. This allows attackers to create look-alike domains for popular services such as banks, social media platforms, or email providers. The success of this attack relies heavily on social engineering, where the attacker lures the victim into trusting the visual appearance of the URL rather than verifying its cryptographic authenticity through certificate validation alone. Consequently, users may inadvertently submit sensitive credentials, personal data, or financial information to malicious servers that mimic legitimate interfaces with high fidelity.
In terms of industry standards and threat modeling, this vulnerability aligns closely with CWE-1021: Improper Restriction of Rendered UI Layers or Frames, specifically regarding the manipulation of user interface elements to deceive users. It also maps directly to MITRE ATT&CK technique T1498: Network Sniffing via Spoofed Addresses and more pertinently T1566.002: Spearphishing Link, where attackers use crafted links that appear safe but redirect to malicious destinations. The severity is classified as Medium by the Chromium security team because while it does not allow for direct code execution or sandbox escape on its own, it serves as a critical enabler for credential theft and further exploitation phases such as malware delivery via drive-by downloads once the user has been tricked into visiting the site.
Mitigation strategies primarily involve updating to Google Chrome version 153.0.8010.36 or later, where these rendering inconsistencies have been addressed through improved normalization algorithms that enforce stricter rules on domain name display and IDN (Internationalized Domain Name) handling. For organizations relying on older versions due to compatibility constraints, implementing strict Content Security Policies can help mitigate some downstream risks by restricting script execution from untrusted origins. Additionally, user education remains a vital defense layer; training personnel to verify the exact spelling of domains and look for security indicators such as valid SSL/TLS certificates issued specifically to the expected organization is essential. Browser extensions that provide enhanced URL inspection or highlight potential homograph attacks can also serve as an additional technical control to detect these visual spoofing attempts before they result in data compromise.