{"id":"CVE-2026-87615","title":"Race condition in Payments in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page","summary":"Race condition in Payments in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","cwe":["CWE-362"],"vendor":"google","product":"chrome","affected":["chrome < 153.0.8010.36"],"patched":["chrome 153.0.8010.36"],"published":"2026-09-09","updated":"2026-09-10","sourceUpdated":"2026-09-10T13:43:36.063","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87615","references":[{"url":"https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html","label":"chrome-cve-admin@google.com"},{"url":"https://issues.chromium.org/issues/501643868","label":"chrome-cve-admin@google.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-87615.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-87615"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-87615"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-09T19:39:24.833512Z"},"epss":0.00141,"epssPercentile":0.03813,"scores":{"nvd":5.4,"vendor":4.3,"adp":5.4},"ingestedAt":"2026-09-09T01:17:17.510Z","slug":"CVE-2026-87615","body":"## Overview\n\nRace condition in Payments in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)\n\n## Affected\n\n- `chrome < 153.0.8010.36`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `chrome 153.0.8010.36`\n\n## Vendor advisories\n\n- **Red Hat VEX** · updated 2026-09-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-87615.json)","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":202541,"id":"CVE-2026-87615","ts":1789400085888,"field":"cvss","old":null,"new":"5.4"},{"seq":202540,"id":"CVE-2026-87615","ts":1789400085888,"field":"severity","old":"none","new":"medium"},{"seq":201268,"id":"CVE-2026-87615","ts":1789397620525,"field":"cvss","old":"5.4","new":null},{"seq":201267,"id":"CVE-2026-87615","ts":1789397620525,"field":"severity","old":"medium","new":"none"},{"seq":199961,"id":"CVE-2026-87615","ts":1789395578461,"field":"cvss","old":null,"new":"5.4"},{"seq":199960,"id":"CVE-2026-87615","ts":1789395578461,"field":"severity","old":"none","new":"medium"},{"seq":199200,"id":"CVE-2026-87615","ts":1789392260580,"field":"cvss","old":"5.4","new":null},{"seq":199199,"id":"CVE-2026-87615","ts":1789392260580,"field":"severity","old":"medium","new":"none"},{"seq":197533,"id":"CVE-2026-87615","ts":1789384297096,"field":"cvss","old":null,"new":"5.4"},{"seq":197532,"id":"CVE-2026-87615","ts":1789384297096,"field":"severity","old":"none","new":"medium"},{"seq":196807,"id":"CVE-2026-87615","ts":1789383778216,"field":"cvss","old":"5.4","new":null},{"seq":196806,"id":"CVE-2026-87615","ts":1789383778216,"field":"severity","old":"medium","new":"none"},{"seq":195711,"id":"CVE-2026-87615","ts":1789380578489,"field":"cvss","old":null,"new":"5.4"},{"seq":195710,"id":"CVE-2026-87615","ts":1789380578489,"field":"severity","old":"none","new":"medium"},{"seq":194662,"id":"CVE-2026-87615","ts":1789378789729,"field":"cvss","old":"5.4","new":null},{"seq":194661,"id":"CVE-2026-87615","ts":1789378789729,"field":"severity","old":"medium","new":"none"},{"seq":193449,"id":"CVE-2026-87615","ts":1789376521173,"field":"cvss","old":null,"new":"5.4"},{"seq":193448,"id":"CVE-2026-87615","ts":1789376521173,"field":"severity","old":"none","new":"medium"},{"seq":192236,"id":"CVE-2026-87615","ts":1789373639548,"field":"cvss","old":"5.4","new":null},{"seq":192235,"id":"CVE-2026-87615","ts":1789373639548,"field":"severity","old":"medium","new":"none"},{"seq":191021,"id":"CVE-2026-87615","ts":1789369488933,"field":"cvss","old":null,"new":"5.4"},{"seq":191020,"id":"CVE-2026-87615","ts":1789369488933,"field":"severity","old":"none","new":"medium"},{"seq":189808,"id":"CVE-2026-87615","ts":1789368461113,"field":"cvss","old":"5.4","new":null},{"seq":189807,"id":"CVE-2026-87615","ts":1789368461113,"field":"severity","old":"medium","new":"none"},{"seq":188591,"id":"CVE-2026-87615","ts":1789365237070,"field":"cvss","old":null,"new":"5.4"},{"seq":188590,"id":"CVE-2026-87615","ts":1789365237070,"field":"severity","old":"none","new":"medium"},{"seq":187378,"id":"CVE-2026-87615","ts":1789363480456,"field":"cvss","old":"5.4","new":null},{"seq":187377,"id":"CVE-2026-87615","ts":1789363480456,"field":"severity","old":"medium","new":"none"},{"seq":186164,"id":"CVE-2026-87615","ts":1789361235747,"field":"cvss","old":null,"new":"5.4"},{"seq":186163,"id":"CVE-2026-87615","ts":1789361235747,"field":"severity","old":"none","new":"medium"},{"seq":184951,"id":"CVE-2026-87615","ts":1789358380167,"field":"cvss","old":"5.4","new":null},{"seq":184950,"id":"CVE-2026-87615","ts":1789358380167,"field":"severity","old":"medium","new":"none"},{"seq":183200,"id":"CVE-2026-87615","ts":1789354323625,"field":"cvss","old":null,"new":"5.4"},{"seq":183199,"id":"CVE-2026-87615","ts":1789354323625,"field":"severity","old":"none","new":"medium"},{"seq":181993,"id":"CVE-2026-87615","ts":1789353335426,"field":"cvss","old":"5.4","new":null},{"seq":181992,"id":"CVE-2026-87615","ts":1789353335426,"field":"severity","old":"medium","new":"none"},{"seq":180786,"id":"CVE-2026-87615","ts":1789350291070,"field":"cvss","old":null,"new":"5.4"},{"seq":180785,"id":"CVE-2026-87615","ts":1789350291070,"field":"severity","old":"none","new":"medium"},{"seq":179579,"id":"CVE-2026-87615","ts":1789348308756,"field":"cvss","old":"5.4","new":null},{"seq":179578,"id":"CVE-2026-87615","ts":1789348308756,"field":"severity","old":"medium","new":"none"},{"seq":178372,"id":"CVE-2026-87615","ts":1789346378074,"field":"cvss","old":null,"new":"5.4"},{"seq":178371,"id":"CVE-2026-87615","ts":1789346378074,"field":"severity","old":"none","new":"medium"},{"seq":177165,"id":"CVE-2026-87615","ts":1789343188721,"field":"cvss","old":"5.4","new":null},{"seq":177164,"id":"CVE-2026-87615","ts":1789343188721,"field":"severity","old":"medium","new":"none"},{"seq":175282,"id":"CVE-2026-87615","ts":1789334884761,"field":"cvss","old":null,"new":"5.4"},{"seq":175281,"id":"CVE-2026-87615","ts":1789334884761,"field":"severity","old":"none","new":"medium"},{"seq":174077,"id":"CVE-2026-87615","ts":1789333703845,"field":"cvss","old":"5.4","new":null},{"seq":174076,"id":"CVE-2026-87615","ts":1789333703845,"field":"severity","old":"medium","new":"none"},{"seq":172891,"id":"CVE-2026-87615","ts":1789331097072,"field":"cvss","old":null,"new":"5.4"},{"seq":172890,"id":"CVE-2026-87615","ts":1789331097072,"field":"severity","old":"none","new":"medium"}]}