{"id":"CVE-2026-87538","title":"Clickjacking in Input in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to spoof UI elements via a crafted HTML page","summary":"Clickjacking in Input in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: …","severity":"medium","cvss":4.2,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L","cwe":["CWE-1021"],"vendor":"google","product":"chrome","affected":["chrome < 153.0.8010.36"],"patched":["chrome 153.0.8010.36"],"published":"2026-09-09","updated":"2026-09-10","sourceUpdated":"2026-09-10T18:42:44.277","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87538","references":[{"url":"https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html","label":"chrome-cve-admin@google.com"},{"url":"https://issues.chromium.org/issues/522399466","label":"chrome-cve-admin@google.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-87538.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-87538"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-87538"}],"tags":["nvd","cve.org","csaf","vex","red-hat","score-dispute"],"epss":0.00203,"epssPercentile":0.10567,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-09T19:39:09.465699Z"},"scores":{"nvd":4.2,"vendor":0,"adp":4.2},"ingestedAt":"2026-09-09T01:17:17.506Z","slug":"CVE-2026-87538","body":"## Overview\n\nClickjacking in Input in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)\n\n## Affected\n\n- `chrome < 153.0.8010.36`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `chrome 153.0.8010.36`\n\n## Vendor advisories\n\n- **Red Hat VEX** · updated 2026-09-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-87538.json)","depth":"sunlit","depthScore":23,"depthScoreParts":{"impact":23.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":202386,"id":"CVE-2026-87538","ts":1789400069888,"field":"cvss","old":null,"new":"4.2"},{"seq":202385,"id":"CVE-2026-87538","ts":1789400069888,"field":"severity","old":"none","new":"medium"},{"seq":201113,"id":"CVE-2026-87538","ts":1789397619939,"field":"cvss","old":"4.2","new":null},{"seq":201112,"id":"CVE-2026-87538","ts":1789397619939,"field":"severity","old":"medium","new":"none"},{"seq":199806,"id":"CVE-2026-87538","ts":1789395576668,"field":"cvss","old":null,"new":"4.2"},{"seq":199805,"id":"CVE-2026-87538","ts":1789395576668,"field":"severity","old":"none","new":"medium"},{"seq":199047,"id":"CVE-2026-87538","ts":1789392260050,"field":"cvss","old":"4.2","new":null},{"seq":199046,"id":"CVE-2026-87538","ts":1789392260050,"field":"severity","old":"medium","new":"none"},{"seq":197380,"id":"CVE-2026-87538","ts":1789384296584,"field":"cvss","old":null,"new":"4.2"},{"seq":197379,"id":"CVE-2026-87538","ts":1789384296584,"field":"severity","old":"none","new":"medium"},{"seq":196654,"id":"CVE-2026-87538","ts":1789383767993,"field":"cvss","old":"4.2","new":null},{"seq":196653,"id":"CVE-2026-87538","ts":1789383767993,"field":"severity","old":"medium","new":"none"},{"seq":195558,"id":"CVE-2026-87538","ts":1789380577464,"field":"cvss","old":null,"new":"4.2"},{"seq":195557,"id":"CVE-2026-87538","ts":1789380577464,"field":"severity","old":"none","new":"medium"},{"seq":194509,"id":"CVE-2026-87538","ts":1789378789192,"field":"cvss","old":"4.2","new":null},{"seq":194508,"id":"CVE-2026-87538","ts":1789378789192,"field":"severity","old":"medium","new":"none"},{"seq":193296,"id":"CVE-2026-87538","ts":1789376520603,"field":"cvss","old":null,"new":"4.2"},{"seq":193295,"id":"CVE-2026-87538","ts":1789376520603,"field":"severity","old":"none","new":"medium"},{"seq":192083,"id":"CVE-2026-87538","ts":1789373638961,"field":"cvss","old":"4.2","new":null},{"seq":192082,"id":"CVE-2026-87538","ts":1789373638961,"field":"severity","old":"medium","new":"none"},{"seq":190868,"id":"CVE-2026-87538","ts":1789369487459,"field":"cvss","old":null,"new":"4.2"},{"seq":190867,"id":"CVE-2026-87538","ts":1789369487459,"field":"severity","old":"none","new":"medium"},{"seq":189655,"id":"CVE-2026-87538","ts":1789368460563,"field":"cvss","old":"4.2","new":null},{"seq":189654,"id":"CVE-2026-87538","ts":1789368460563,"field":"severity","old":"medium","new":"none"},{"seq":188438,"id":"CVE-2026-87538","ts":1789365236531,"field":"cvss","old":null,"new":"4.2"},{"seq":188437,"id":"CVE-2026-87538","ts":1789365236531,"field":"severity","old":"none","new":"medium"},{"seq":187225,"id":"CVE-2026-87538","ts":1789363479911,"field":"cvss","old":"4.2","new":null},{"seq":187224,"id":"CVE-2026-87538","ts":1789363479911,"field":"severity","old":"medium","new":"none"},{"seq":186011,"id":"CVE-2026-87538","ts":1789361235166,"field":"cvss","old":null,"new":"4.2"},{"seq":186010,"id":"CVE-2026-87538","ts":1789361235166,"field":"severity","old":"none","new":"medium"},{"seq":184798,"id":"CVE-2026-87538","ts":1789358376909,"field":"cvss","old":"4.2","new":null},{"seq":184797,"id":"CVE-2026-87538","ts":1789358376909,"field":"severity","old":"medium","new":"none"},{"seq":183047,"id":"CVE-2026-87538","ts":1789354323013,"field":"cvss","old":null,"new":"4.2"},{"seq":183046,"id":"CVE-2026-87538","ts":1789354323013,"field":"severity","old":"none","new":"medium"},{"seq":181840,"id":"CVE-2026-87538","ts":1789353334888,"field":"cvss","old":"4.2","new":null},{"seq":181839,"id":"CVE-2026-87538","ts":1789353334888,"field":"severity","old":"medium","new":"none"},{"seq":180633,"id":"CVE-2026-87538","ts":1789350290504,"field":"cvss","old":null,"new":"4.2"},{"seq":180632,"id":"CVE-2026-87538","ts":1789350290504,"field":"severity","old":"none","new":"medium"},{"seq":179426,"id":"CVE-2026-87538","ts":1789348308182,"field":"cvss","old":"4.2","new":null},{"seq":179425,"id":"CVE-2026-87538","ts":1789348308182,"field":"severity","old":"medium","new":"none"},{"seq":178219,"id":"CVE-2026-87538","ts":1789346377537,"field":"cvss","old":null,"new":"4.2"},{"seq":178218,"id":"CVE-2026-87538","ts":1789346377537,"field":"severity","old":"none","new":"medium"},{"seq":177012,"id":"CVE-2026-87538","ts":1789343188120,"field":"cvss","old":"4.2","new":null},{"seq":177011,"id":"CVE-2026-87538","ts":1789343188120,"field":"severity","old":"medium","new":"none"},{"seq":175129,"id":"CVE-2026-87538","ts":1789334884163,"field":"cvss","old":null,"new":"4.2"},{"seq":175128,"id":"CVE-2026-87538","ts":1789334884163,"field":"severity","old":"none","new":"medium"},{"seq":173924,"id":"CVE-2026-87538","ts":1789333703306,"field":"cvss","old":"4.2","new":null},{"seq":173923,"id":"CVE-2026-87538","ts":1789333703306,"field":"severity","old":"medium","new":"none"},{"seq":172738,"id":"CVE-2026-87538","ts":1789331096540,"field":"cvss","old":null,"new":"4.2"},{"seq":172737,"id":"CVE-2026-87538","ts":1789331096540,"field":"severity","old":"none","new":"medium"}]}