CVE-2026-87481

CVE-2026-87481 is an incorrect authorization flaw (CWE-863) in the WebView component of Google Chrome on Android, fixed in version 153.0.8010.36. To trigger it, an attacker crafts a malicious HTML page that a user must load; after compromising the browser's renderer process, the flaw lets the attacker bypass an authorization check and execute arbitrary code outside the browser sandbox. Successful exploitation effectively turns a renderer-level compromise into a sandbox escape, with high confidentiality, integrity, and availability impact on the affected Android device. Only Chrome on Android prior to 153.0.8010.36 is named as affected; desktop platforms and other products are not listed in the advisory. No public proof-of-concept, no CISA KEV listing, and a low EPSS score (0.3%, 23rd percentile) indicate no confirmed exploitation at this time, though Google's CVSS score of 8.3 (High) reflects the severity of the potential impact.

What to do: Update Google Chrome on Android to version 153.0.8010.36 or later via Google Play, and verify the installed version on managed devices through MDM or the browser's About/Settings page. As an interim mitigation, avoid loading untrusted web content in Chrome on Android, since exploitation requires both a crafted HTML page and a prior renderer-process compromise. Note the flaw is rated Medium by Chromium but High (8.3) under CVSS, so prioritize patching internet-facing and at-risk mobile fleets despite the absence of known exploitation.