CVE-2026-87540

CVE-2026-87540 is an incorrect authorization flaw (CWE-863) in the Isolated component of Google Chrome that lets a remote attacker spoof UI elements. Triggering it requires luring a user to open a crafted HTML page, which is reflected in the CVSS 3.1 user-interaction requirement. If successful, the attacker can present misleading browser or page UI, which is typically leveraged for phishing or deceiving users about what they are interacting with. All Chrome users running versions before 153.0.8010.36 are affected. Exploitation has not been observed in the wild (not in CISA KEV, EPSS is 0.2%), but one public proof-of-concept reference exists in the Chromium issue tracker.

What to do: Update Google Chrome to version 153.0.8010.36 or later; users can verify their current version at chrome://settings/help and relaunch after the update applies. Enterprise administrators should push the updated build through their patch-management channel. As an interim mitigation, exercise caution when opening HTML pages from untrusted sources.