CVE-2026-87597 in Chrome
Summary
by MITRE • 09/09/2026
UI misrepresentation in CustomTabs in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to spoof address bar via a co-installed app. (Chromium security severity: Low)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as UI misrepresentation within the CustomTabs implementation of Google Chrome for Android prior to version 153.0.8010.36 represents a significant trust boundary violation that undermines user confidence in web navigation contexts. This flaw specifically affects scenarios where third-party applications utilize the CustomTabs API to launch web content within the browser's interface rather than opening an external browser window. The core technical deficiency lies in the failure of the Chrome UI layer to accurately reflect the true origin or identity of the webpage being displayed when initiated by a co-installed application. This discrepancy creates a visual environment where the address bar, which serves as the primary indicator of site authenticity for end-users, displays misleading information that does not align with the actual Uniform Resource Identifier (URI) loaded in the background.
From an operational perspective, this vulnerability enables remote attackers or malicious local applications to perform sophisticated phishing attacks through UI spoofing techniques. By leveraging a co-installed app that has legitimate access to launch CustomTabs, an attacker can manipulate the visual presentation of the address bar to mimic trusted domains such as banking institutions, email providers, or social media platforms. Since users typically rely on the visible URL in the browser interface to verify they are interacting with the correct entity, this misrepresentation allows malicious actors to trick victims into entering sensitive credentials, personal identifiable information, or financial data under the false assumption that they are visiting a legitimate site. The severity is classified as low by Chromium security standards because it requires local application co-installation and user interaction, yet its impact on trust and potential for credential harvesting remains substantial in social engineering contexts.
This vulnerability aligns with Common Weakness Enumeration (CWE) category CWE-1021: Improper Restriction of Rendered UI Layers or Frames, which describes flaws where the rendering context allows unauthorized modification of visual elements that convey security-critical information. Furthermore, it maps to MITRE ATT&CK technique T1657: Impersonation, specifically within the sub-context of phishing via spoofing interfaces. The attack vector relies on the attacker controlling a local application component that interacts with the browser shell, exploiting the lack of strict validation or synchronization between the app-provided intent data and the UI rendering engine responsible for displaying the address bar contents.
Mitigation strategies primarily involve updating Google Chrome to version 153.0.8010.36 or later on Android devices, as this release contains patches that enforce stricter consistency checks between the loaded URL and its visual representation in CustomTabs sessions. For application developers utilizing CustomTabs APIs, it is critical to ensure that any custom UI modifications do not obscure or alter native security indicators such as the address bar unless explicitly permitted by secure design patterns that maintain user awareness of the true origin. Security teams should also monitor for unusual activity involving applications requesting browser launch intents and educate users on verifying URLs through secondary means when in doubt, although technical remediation via patching remains the most effective defense against this specific class of UI spoofing vulnerabilities.