CVE-2026-87655 in Chrome
Summary
by MITRE • 09/09/2026
Clickjacking in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as clickjacking within the download functionality of Google Chrome versions prior to 153.0.8010.36 represents a significant user interface deception risk that exploits the browser's handling of file downloads and overlay rendering. This flaw allows an attacker, through social engineering techniques, to manipulate the visual presentation of web pages in such a way that users are tricked into interacting with hidden or obscured elements. Specifically, by embedding malicious HTML content within iframes or using CSS positioning tricks, an adversary can place invisible buttons over legitimate download prompts or other interactive UI components. When a user believes they are clicking on one element, such as a benign link or button, their click is actually registered by the underlying deceptive layer, potentially triggering unintended actions like downloading malware-laden files or submitting sensitive data to attacker-controlled servers without explicit consent.
From a technical perspective, this vulnerability stems from insufficient isolation and validation of user input contexts within the browser's rendering engine. The Chromium security severity rating for this issue as Medium reflects its potential impact on system integrity and user trust rather than direct remote code execution. However, the operational consequences can be severe depending on the payload delivered via the spoofed download mechanism. Attackers typically leverage these techniques in phishing campaigns where they create deceptive landing pages that mimic trusted entities or offer enticing but malicious downloads. The lack of robust frame-busting mechanisms or proper origin checks for certain UI elements allows this manipulation to succeed, particularly when users are not vigilant about verifying the actual destination and nature of their interactions on web pages.
The impact of such clickjacking attacks extends beyond immediate data theft; it undermines the fundamental trust model of the browser environment. Users rely on visual cues provided by the user interface to make informed decisions about security risks associated with downloads and form submissions. When these cues are spoofed, users may inadvertently compromise their systems by installing malicious software or exposing credentials. This type of attack is particularly dangerous because it bypasses traditional perimeter defenses that focus solely on network-level threats, targeting instead the human element through sophisticated visual deception. The ability to force a download via clickjacking means that even if the user does not actively seek out malware, they can be coerced into acquiring and executing harmful files under false pretenses.
Mitigation strategies for this vulnerability involve both technical fixes within the browser software and defensive practices recommended by industry standards such as those outlined in CWE-1021: Improper Restriction of Rendered UI Layers or Frames (Clickjacking). For users, upgrading to Google Chrome version 153.0.8010.36 or later is essential as it addresses the underlying rendering flaws that permitted this manipulation. Additionally, enabling features like X-Frame-Options and Content Security Policy headers on web applications can help prevent unauthorized framing of site content, thereby reducing the attack surface for clickjacking attempts. Developers should also implement frame-busting scripts to ensure their pages cannot be embedded in malicious iframes. From a security operations perspective, educating users about social engineering tactics and encouraging cautious behavior when interacting with unfamiliar websites or unexpected download prompts remains critical. Regularly updating browsers ensures that known vulnerabilities like this one are patched, maintaining the integrity of the browsing experience against evolving threats categorized under MITRE ATT&CK techniques related to UI redressing and drive-by downloads.