CVE-2026-87640

CVE-2026-87640 is an out-of-bounds read (CWE-125) in the WebView component of Google Chrome on Android, fixed in Chrome 153.0.8010.36. It is triggered when the browser renders a crafted HTML page, allowing an attacker who has already compromised the renderer process to read memory outside the sandbox. Successful exploitation results in information disclosure from memory outside the WebView sandbox; as a Medium-severity read bug, it does not by itself provide code execution or privilege escalation. Only Chrome on Android builds prior to 153.0.8010.36 are named in the advisory; other platforms are not listed as affected. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known for this specific flaw (EPSS 0.2%), though the same Chrome 153 release also patched a separate 0-day that is being exploited.

What to do: Update Chrome for Android to 153.0.8010.36 or later via the Google Play Store and enable automatic updates; verify the installed version at chrome://version. No workaround is available beyond patching, and defenders should ensure the full Chrome 153 rollup is applied since the same release fixed a separate 0-day exploited in the wild.