CVE-2026-87623 in Chrome
Summary
by MITRE • 09/09/2026
Observable discrepancy in DOM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as an observable discrepancy in the Document Object Model within Google Chrome prior to version 153.0.8010.36 represents a significant breach of browser isolation principles, specifically affecting how content is rendered and exposed to scripts. This flaw stems from inconsistencies between the internal state of the DOM tree and its external representation or accessibility features, which can be exploited by malicious actors through social engineering tactics. When a user visits a specially crafted HTML page designed to trigger this discrepancy, the browser may expose sensitive information that should remain hidden or restricted due to same-origin policy constraints. The severity is classified as medium because while it does not allow for direct code execution on the victim's machine, it facilitates data exfiltration by leaking internal state details that can be correlated with other known vulnerabilities or used in conjunction with phishing attacks to steal credentials or session tokens.
From a technical perspective, this issue highlights a failure in the browser's ability to maintain strict boundaries between different security contexts during DOM manipulation and rendering processes. The attacker crafts an HTML page containing specific JavaScript sequences that interact with elements whose visibility or state is manipulated via CSS or other styling mechanisms. Due to the discrepancy, these interactions reveal information about hidden fields, internal attributes, or layout calculations that are not intended for script access. This type of flaw often relates to timing attacks or side-channel leaks where the mere presence or absence of certain DOM properties alters performance metrics or error states in a way that can be detected by an observer. Such behavior undermines the fundamental assumption that scripts running on one origin cannot infer details about resources from another origin, thereby weakening the sandbox environment provided by modern web browsers.
The operational impact of this vulnerability is primarily centered around information disclosure and potential credential theft through sophisticated social engineering campaigns. An attacker would need to lure a victim into visiting a malicious website, often disguised as a legitimate service or containing compelling content that encourages interaction. Once on the page, the crafted script exploits the DOM discrepancy to gather sensitive data such as form field values, internal application states, or metadata about other open tabs if cross-origin access is partially compromised. This information can then be sent back to an attacker-controlled server for analysis and exploitation. The medium severity rating reflects that while the attack requires user interaction and does not provide full system compromise, it significantly lowers the barrier for phishing success by providing attackers with additional context or data points that enhance their ability to impersonate trusted entities or bypass multi-factor authentication mechanisms that rely on device fingerprinting or behavioral analytics.
Mitigation strategies focus primarily on updating the browser software to a version where this discrepancy has been resolved. Users and organizations should ensure that Google Chrome is updated to version 153.0.8010.36 or later, as these patches include fixes for the underlying DOM handling logic that caused the observable differences. In addition to patching, security teams should implement strict Content Security Policy headers to restrict inline scripts and limit the sources from which content can be loaded, thereby reducing the attack surface available to such crafted pages. Monitoring browser console logs for unusual errors or performance anomalies may also help in detecting active exploitation attempts. Furthermore, educating users about social engineering tactics remains critical, as this vulnerability relies heavily on tricking individuals into interacting with malicious web content rather than exploiting a purely technical flaw that could be triggered automatically without user involvement.
This incident aligns with common weakness enumerations related to improper restriction of observable behavior and information leakage through side channels. It also maps to techniques found in the MITRE ATT&CK framework, particularly those involving browser-based reconnaissance or data exfiltration via web browsers. By addressing these vulnerabilities promptly and reinforcing defense-in-depth measures such as CSP and user awareness training, organizations can significantly reduce their risk profile against this class of attacks that exploit subtle inconsistencies in how modern web standards are implemented across different rendering engines.