{"id":"CVE-2026-87501","title":"UI misrepresentation in Passwords in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML page","summary":"UI misrepresentation in Passwords in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","cwe":["CWE-451"],"vendor":"google","product":"chrome","affected":["chrome < 153.0.8010.36"],"patched":["chrome 153.0.8010.36"],"published":"2026-09-09","updated":"2026-09-10","sourceUpdated":"2026-09-10T19:22:21.393","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87501","references":[{"url":"https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html","label":"chrome-cve-admin@google.com"},{"url":"https://issues.chromium.org/issues/513509804","label":"chrome-cve-admin@google.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-87501.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-87501"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-87501"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87501"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"epss":0.00184,"epssPercentile":0.08246,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-09T19:39:21.690967Z"},"ingestedAt":"2026-09-09T01:17:17.509Z","slug":"CVE-2026-87501","body":"## Overview\n\nUI misrepresentation in Passwords in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)\n\n## Affected\n\n- `chrome < 153.0.8010.36`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `chrome 153.0.8010.36`\n\n## Vendor advisories\n\n- **Red Hat VEX** · updated 2026-09-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-87501.json)","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":202312,"id":"CVE-2026-87501","ts":1789400065447,"field":"cvss","old":null,"new":"5.4"},{"seq":202311,"id":"CVE-2026-87501","ts":1789400065447,"field":"severity","old":"none","new":"medium"},{"seq":201039,"id":"CVE-2026-87501","ts":1789397619362,"field":"cvss","old":"5.4","new":null},{"seq":201038,"id":"CVE-2026-87501","ts":1789397619362,"field":"severity","old":"medium","new":"none"},{"seq":199732,"id":"CVE-2026-87501","ts":1789395570885,"field":"cvss","old":null,"new":"5.4"},{"seq":199731,"id":"CVE-2026-87501","ts":1789395570885,"field":"severity","old":"none","new":"medium"},{"seq":198973,"id":"CVE-2026-87501","ts":1789392258947,"field":"cvss","old":"5.4","new":null},{"seq":198972,"id":"CVE-2026-87501","ts":1789392258947,"field":"severity","old":"medium","new":"none"},{"seq":197306,"id":"CVE-2026-87501","ts":1789384296348,"field":"cvss","old":null,"new":"5.4"},{"seq":197305,"id":"CVE-2026-87501","ts":1789384296348,"field":"severity","old":"none","new":"medium"},{"seq":196580,"id":"CVE-2026-87501","ts":1789383763111,"field":"cvss","old":"5.4","new":null},{"seq":196579,"id":"CVE-2026-87501","ts":1789383763111,"field":"severity","old":"medium","new":"none"},{"seq":195484,"id":"CVE-2026-87501","ts":1789380577202,"field":"cvss","old":null,"new":"5.4"},{"seq":195483,"id":"CVE-2026-87501","ts":1789380577202,"field":"severity","old":"none","new":"medium"},{"seq":194435,"id":"CVE-2026-87501","ts":1789378786486,"field":"cvss","old":"5.4","new":null},{"seq":194434,"id":"CVE-2026-87501","ts":1789378786486,"field":"severity","old":"medium","new":"none"},{"seq":193222,"id":"CVE-2026-87501","ts":1789376520327,"field":"cvss","old":null,"new":"5.4"},{"seq":193221,"id":"CVE-2026-87501","ts":1789376520327,"field":"severity","old":"none","new":"medium"},{"seq":192009,"id":"CVE-2026-87501","ts":1789373637390,"field":"cvss","old":"5.4","new":null},{"seq":192008,"id":"CVE-2026-87501","ts":1789373637390,"field":"severity","old":"medium","new":"none"},{"seq":190794,"id":"CVE-2026-87501","ts":1789369487161,"field":"cvss","old":null,"new":"5.4"},{"seq":190793,"id":"CVE-2026-87501","ts":1789369487161,"field":"severity","old":"none","new":"medium"},{"seq":189581,"id":"CVE-2026-87501","ts":1789368459325,"field":"cvss","old":"5.4","new":null},{"seq":189580,"id":"CVE-2026-87501","ts":1789368459325,"field":"severity","old":"medium","new":"none"},{"seq":188364,"id":"CVE-2026-87501","ts":1789365236282,"field":"cvss","old":null,"new":"5.4"},{"seq":188363,"id":"CVE-2026-87501","ts":1789365236282,"field":"severity","old":"none","new":"medium"},{"seq":187151,"id":"CVE-2026-87501","ts":1789363478795,"field":"cvss","old":"5.4","new":null},{"seq":187150,"id":"CVE-2026-87501","ts":1789363478795,"field":"severity","old":"medium","new":"none"},{"seq":185937,"id":"CVE-2026-87501","ts":1789361234907,"field":"cvss","old":null,"new":"5.4"},{"seq":185936,"id":"CVE-2026-87501","ts":1789361234907,"field":"severity","old":"none","new":"medium"},{"seq":184724,"id":"CVE-2026-87501","ts":1789358375653,"field":"cvss","old":"5.4","new":null},{"seq":184723,"id":"CVE-2026-87501","ts":1789358375653,"field":"severity","old":"medium","new":"none"},{"seq":182973,"id":"CVE-2026-87501","ts":1789354322721,"field":"cvss","old":null,"new":"5.4"},{"seq":182972,"id":"CVE-2026-87501","ts":1789354322721,"field":"severity","old":"none","new":"medium"},{"seq":181766,"id":"CVE-2026-87501","ts":1789353333429,"field":"cvss","old":"5.4","new":null},{"seq":181765,"id":"CVE-2026-87501","ts":1789353333429,"field":"severity","old":"medium","new":"none"},{"seq":180559,"id":"CVE-2026-87501","ts":1789350290251,"field":"cvss","old":null,"new":"5.4"},{"seq":180558,"id":"CVE-2026-87501","ts":1789350290251,"field":"severity","old":"none","new":"medium"},{"seq":179352,"id":"CVE-2026-87501","ts":1789348306338,"field":"cvss","old":"5.4","new":null},{"seq":179351,"id":"CVE-2026-87501","ts":1789348306338,"field":"severity","old":"medium","new":"none"},{"seq":178145,"id":"CVE-2026-87501","ts":1789346377288,"field":"cvss","old":null,"new":"5.4"},{"seq":178144,"id":"CVE-2026-87501","ts":1789346377288,"field":"severity","old":"none","new":"medium"},{"seq":176938,"id":"CVE-2026-87501","ts":1789343187388,"field":"cvss","old":"5.4","new":null},{"seq":176937,"id":"CVE-2026-87501","ts":1789343187388,"field":"severity","old":"medium","new":"none"},{"seq":175055,"id":"CVE-2026-87501","ts":1789334883872,"field":"cvss","old":null,"new":"5.4"},{"seq":175054,"id":"CVE-2026-87501","ts":1789334883872,"field":"severity","old":"none","new":"medium"},{"seq":173850,"id":"CVE-2026-87501","ts":1789333703044,"field":"cvss","old":"5.4","new":null},{"seq":173849,"id":"CVE-2026-87501","ts":1789333703044,"field":"severity","old":"medium","new":"none"},{"seq":172664,"id":"CVE-2026-87501","ts":1789331096274,"field":"cvss","old":null,"new":"5.4"},{"seq":172663,"id":"CVE-2026-87501","ts":1789331096274,"field":"severity","old":"none","new":"medium"}]}