Executive brief
Google Chrome contains a clickjacking vulnerability in the input element rendering that allows an attacker to spoof UI elements when the renderer process has been compromised. While exploitation requires the attacker to first compromise the renderer and use social engineering, a successful attack could trick users into performing unintended actions, potentially leading to account compromise or unauthorized operations.
Technical details
This is a clickjacking vulnerability (CWE-1021) in Chrome's input rendering that allows spoofing of UI elements. The attack requires two preconditions: the renderer process must already be compromised by an attacker, and social engineering tactics must be employed to deceive the user. The vulnerable component is the input element rendering logic in Chrome prior to version 153.0.8010.36. An attacker who has achieved renderer process compromise can craft malicious HTML to visually obscure or misrepresent UI elements, tricking users into unintended interactions. The fix is available in Chrome 153.0.8010.36 and later for Windows, Mac, and Linux.
Affected products
- Google Chrome prior to 153.0.8010.36
Timeline
- 2026-09-09: disclosed
- 2026-09-08: patched: Chrome 153.0.8010.36 released