What is the CVSS score of CVE-2026-87653?

CVE-2026-87653 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-87653?

Yes, a patch is available for CVE-2026-87653. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-87653

EUVD-2026-74431 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-09-09 Chrome

GHSA-659r-xrrg-p75v

Google

5.4

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

vuln.today AI

5.4 MEDIUM

UI spoofing can induce credential disclosure (C:L) and user deception leading to integrity-impacting actions (I:L); no availability impact is plausible for a rendering misrepresentation flaw.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

Low

Lifecycle Timeline

Metadata Corrected

Sep 09, 2026 - 20:40 vuln.today

tag: Information Disclosure removed

Metadata Corrected

Sep 09, 2026 - 20:40 vuln.today

tag: Microsoft removed

Analysis Generated

Sep 09, 2026 - 20:30 vuln.today

Patch available

Sep 09, 2026 - 01:03 EUVD

CVE Published

Sep 09, 2026 - 00:09 cve.org

UNKNOWN (no severity yet)

CVE Published

Sep 09, 2026 - 00:09 cve.org

MEDIUM 5.4

DescriptionCVE.org

UI misrepresentation in FullScreen in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

UI misrepresentation in Google Chrome's FullScreen mode on Windows allows a remote attacker to spoof browser chrome and security-relevant UI elements by directing a victim to a crafted HTML page. Affected are all Chrome versions on Windows prior to 153.0.8010.36. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	The victim must be running Google Chrome on Windows prior to version 153.0.8010.36 and must interact with a crafted HTML page (UI:R - a click or other user gesture is typically required to trigger the Fullscreen API). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The provided CVSS 5.4 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L) appropriately reflects the moderate risk: network-reachable with no privilege requirement, but requiring user interaction (visiting a crafted page) and limited in scope. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	The vendor-released patch is Chrome 153.0.8010.36, delivered through the Chrome stable-channel update announced on the Chrome Releases blog (chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html). … Detailed patch versions, workarounds, and compensating controls in full report.