CVE-2026-87615 in Chrome
Summary
by MITRE • 09/09/2026
Race condition in Payments in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as CVE-2024-9718 represents a critical race condition within the payment handling subsystem of Google Chrome, specifically affecting versions prior to 153.0.8010.36. This flaw stems from improper synchronization mechanisms when processing asynchronous requests related to web payments. In modern browser architectures, multiple threads often handle user interactions and background processes simultaneously. When a race condition occurs in this context, the application state may be accessed or modified by one thread while another is still relying on outdated information. Specifically, during the execution of payment flows initiated via HTML pages, the timing discrepancy allows an attacker to manipulate the sequence of events such that the browser's user interface displays misleading information. This manipulation does not necessarily involve breaking encryption protocols or executing arbitrary code directly but rather exploits the visual and logical state of the application to deceive the end-user.
From a technical perspective, this vulnerability is classified under CWE-362, which denotes concurrent execution with shared resources leading to race conditions. The core issue lies in how Chrome manages the transition between different states during a payment transaction. If an attacker can trigger specific actions faster than the browser's internal state machine can update its UI representation, they can create a window of opportunity where the displayed interface does not accurately reflect the actual operation being performed by the backend services or the script logic. This discrepancy is particularly dangerous in financial contexts because users rely heavily on visual cues to confirm that their payment details are correct and that the transaction is proceeding as intended. By crafting an HTML page with carefully timed JavaScript events, a remote attacker can exploit this timing gap to overlay fake confirmation dialogs or alter the displayed merchant information without the user's immediate detection.
The operational impact of this vulnerability is significant due to its reliance on social engineering techniques. While the technical flaw itself allows for UI spoofing, successful exploitation requires the victim to interact with a malicious webpage designed to trigger the race condition. This aligns closely with MITRE ATT&CK technique T1059, specifically command and script interpretation through browser-based vectors, although the primary goal here is deception rather than direct code execution. The attacker leverages this flaw to perform phishing attacks that are far more convincing than traditional static pages. By spoofing UI elements such as payment confirmation buttons or merchant names, the vulnerability enables credential harvesting or unauthorized financial transactions under the guise of legitimate activity. This undermines the trust model inherent in web-based payments, where users assume that the browser interface accurately represents the security status and destination of their data.
Mitigation for this issue primarily involves updating Google Chrome to version 153.0.8010.36 or later, which includes patches addressing the synchronization logic within the payment subsystem. For organizations unable to update immediately due to compatibility constraints, implementing strict Content Security Policy (CSP) headers can help mitigate some risks by restricting the sources from which scripts and resources are loaded, thereby reducing the attack surface for crafted HTML pages. Additionally, user education remains a critical defense layer; users should be trained to verify URLs carefully before entering sensitive payment information and to look for signs of UI inconsistencies that might indicate spoofing attempts. Security monitoring tools can also be configured to detect unusual patterns in network traffic associated with rapid successive requests to payment endpoints, which may signal an attempt to exploit this race condition. Ultimately, maintaining up-to-date software is the most effective countermeasure against such timing-based vulnerabilities that rely on precise execution windows for success.