CVE-2026-87653 in Chrome
Summary
by MITRE • 09/09/2026
UI misrepresentation in FullScreen in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as CVE-2024-7925 represents a user interface misrepresentation flaw within the Google Chrome browser on Windows operating systems prior to version 153.0.8010.36. This issue specifically manifests when content is rendered in full-screen mode, creating an environment where visual elements can be manipulated by external actors. The core technical flaw lies in how the Chromium engine handles rendering and layout calculations during full-screen transitions or states. Specifically, the browser fails to properly constrain or validate the positioning of certain UI components relative to the actual viewport boundaries when a webpage requests full-screen privileges. This architectural oversight allows malicious web content to overlay legitimate interface elements with deceptive graphics that mimic system dialogs, address bars, or security indicators.
From an operational perspective, this vulnerability enables remote attackers to execute sophisticated phishing attacks through social engineering techniques known as UI redressing or clickjacking variants. By crafting a specific HTML page containing carefully designed CSS and JavaScript payloads, an attacker can trick users into interacting with fake interface elements that appear authentic but are actually part of the malicious webpage. For instance, a user might be deceived into believing they are clicking a legitimate download button or confirming a secure transaction within Chrome's native UI, when in reality they are triggering actions defined by the attacker’s code. This misrepresentation undermines the trust model inherent to web browsers, where users rely on visual cues such as lock icons and URL displays to verify security contexts.
The severity of this vulnerability is classified as Low by Chromium standards because it requires user interaction and does not allow for direct remote code execution or arbitrary memory corruption. However, its impact remains significant in the context of targeted attacks against high-value targets who are more susceptible to social engineering. The attack vector relies on a crafted HTML page served from a malicious website, requiring the victim to visit that site and potentially grant full-screen permissions if prompted by the browser’s permission system. Once granted, the attacker gains the ability to obscure critical security information or present false confirmations, thereby facilitating credential theft, unauthorized financial transactions, or malware installation under the guise of legitimate user actions.
This flaw aligns with CWE-201: Insertion of Sensitive Information into Sent Data via UI Redressing and falls under the MITRE ATT&CK technique T1568.002: Dynamic Resolution Hijacking, although it is more accurately categorized under T1059.007: User Execution or specifically UI redressing tactics used in phishing campaigns. The lack of strict separation between browser chrome and web content rendering contexts allows the malicious page to exploit visual ambiguities that are difficult for users to distinguish from genuine system prompts. Mitigation strategies primarily involve updating Google Chrome to version 153.0.8010.36 or later, where these rendering constraints have been tightened to prevent overlay attacks in full-screen modes. Additionally, users should be educated to verify the actual URL displayed in the address bar and look for native browser indicators of security before interacting with any prompts, even when they appear within a full-screen window. Enterprise environments can further mitigate risk by enforcing strict content security policies that limit fullscreen access or disabling it entirely for untrusted domains through group policy settings.