CVE-2026-87534

CVE-2026-87534 is a missing-authorization flaw (CWE-862) in the WebView component of Google Chrome on Android, fixed in Chrome 153.0.8010.36. A remote attacker triggers it by combining crafted network traffic with social engineering — i.e., persuading the user into an action — which allows the attacker to bypass system access restrictions enforced around WebView content. Successful exploitation undermines permission boundaries on the device, with high potential confidentiality and integrity impact per the CVSS vector, although Google rates it only Medium severity and user interaction is required. Affected users are those running Chrome on Android prior to 153.0.8010.36; no other platforms are indicated in the advisory. There is no evidence of active exploitation: the flaw is not in CISA KEV, no public PoC is known, and EPSS is just 0.2% (7th percentile) over the next 30 days.

What to do: Update Chrome on Android to 153.0.8010.36 or later via Google Play (or confirm auto-updates are enabled) and verify the running version at chrome://version; enterprise admins should push the updated package via MDM. Until patched, treat unsolicited links and prompts with extra caution, since exploitation requires social engineering in combination with crafted network traffic.