Vulnerabilities

CVE-2026-87595 is a server-side request forgery (SSRF) flaw in Google Chrome on mobile platforms, fixed in version 153.0.8010.36. It is triggered when a victim is socially engineered into visiting a crafted HTML page, which causes the browser to issue requests that bypass system access restrictions. Successful exploitation could let a remote attacker reach or interact with resources that should be inaccessible from the victim's device context. All users of Chrome on mobile operating systems (Android/iOS) running versions prior to 153.0.8010.36 are affected. Chromium assesses the severity as Low, despite a published CVSS 3.1 score of 9.8; no public proof of concept exists and no exploitation in the wild has been reported (EPSS ~0.2%, not in CISA KEV).

Do: Update Chrome on Android and iOS to 153.0.8010.36 or later via Google Play or the App Store, and confirm automatic updates are enabled for the browser. Enterprise administrators should verify managed mobile fleets have pulled the patched build. Weigh the vendor's Low severity rating over the externally assigned CVSS 9.8 when prioritizing, but patch promptly since exploitation requires only a user clicking a crafted link.

CVE-2026-49883 is a missing permission check in the checkReadPermission function of PermissionsManager.java in Android, categorized as improper privilege management (CWE-269). An app or process on the device can trigger the flaw locally without requiring any additional execution privileges or user interaction, bypassing the permission gate that should protect sensitive device state data. A successful exploit results in local information disclosure, allowing the caller to read sensitive device state information it is not authorized to access. All Android devices running affected versions are potentially exposed, though the available data does not specify which Android version ranges are impacted, so the Android Security Bulletin should be consulted for affected versions and patches. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known; EPSS currently estimates only a 0.2% probability of exploitation within 30 days, despite the critical 10.0 CVSS 4.0 score assigned by Google's Android security team.

Do: Monitor the Android Security Bulletin for CVE-2026-49883 and apply the corresponding monthly security update as soon as affected versions and fixed patch levels are published; users and administrators should check the installed Android security patch level (Settings > About phone > Android security update) and apply updates when a patch level containing the fix is available. Until devices are patched, limit installing untrusted or sideloaded apps, since exploitation requires a local app or process on the device.

CVE-2026-28659 is a missing permission check (CWE-269, improper privilege management) in the MicroXR Blobstore component of the Android platform, assigned by Google's Android security team ([email protected]). A local attacker who can already run code on the affected device can trigger the flaw with no user interaction and no additional execution privileges, gaining access to other apps' files and escalating privileges locally. The issue is rated critical at CVSS 4.0 10.0 in the CVE record, although the described trigger is local code on the device rather than a remote attack. Affected are Android-based devices carrying the MicroXR Blobstore component; the CVE record itself does not list affected version ranges, so defenders must consult the corresponding Android security bulletin for affected and patched patch levels. Exploitation has not been observed: there is no public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS estimates only about a 0.2% probability of exploitation within 30 days (10th percentile).

Do: Check the Android Security Bulletin entry for CVE-2026-28659 to identify the affected components and patched patch levels, and apply the corresponding OTA/system update on any Android XR devices in your estate as soon as it is available. Until patched, treat app-to-app file isolation on these devices as reduced and avoid installing untrusted apps on affected devices, since exploitation requires local code execution. No workaround is documented; with no public PoC and a 0.2% EPSS score, there is currently no indication of active exploitation.

CVE-2026-85050 is an out-of-bounds write (CWE-787) in the WebGL component of Google Chrome running on Android, fixed in version 152.0.7977.82. An attacker can trigger it by persuading a user to open a crafted HTML page, since exploitation requires user interaction but no privileges. Successful exploitation yields arbitrary code execution outside the browser sandbox, giving the attacker the privileges of the user on the device, hence the critical 9.6 CVSS with scope change. Only Chrome on Android versions prior to 152.0.7977.82 are affected by this bug; desktop Chrome is not indicated in the advisory. No public proof-of-concept, KEV listing, or confirmed in-the-wild exploitation of this specific CVE is known, though a related Chrome zero-day (CVE-2026-85046) was reported exploited in the wild and addressed in the same release.

Do: Update Chrome on Android to 152.0.7977.82 or later via the Google Play Store and verify the version in chrome://version. Organizations should check MDM/EMM or Chrome enterprise version reporting for unpatched Android devices and prioritize patching, noting the same release addressed a zero-day (CVE-2026-85046) that was exploited in the wild. As an interim mitigation, users should avoid opening untrusted web pages; no other workaround is known.

CVE-2026-84325 is an improper input validation flaw (CWE-20) in the DataTransfer component of Google Chrome, rated High by Chromium and assigned a CVSS 3.1 base score of 9.8. A remote attacker must combine the flaw with social engineering, persuading a user into a data-transfer interaction that, together with an application co-installed on the same system, bypasses system access restrictions. Successful exploitation grants a bypass of restrictions normally enforced between the browser and locally installed software, with the practical impact depending on the privileges of the co-installed app involved. All users of Google Chrome prior to 152.0.7977.75 are affected; note that the description indicates user interaction (social engineering) is required, despite the UI:N value in the vendor-assigned CVSS vector. There is no public proof-of-concept, the flaw is not in the CISA KEV catalog, and EPSS assigns only a 0.2% probability of exploitation within 30 days, so no exploitation is currently known.

Do: Update Google Chrome to 152.0.7977.75 or later on all endpoints, verifying versions via chrome://settings/help or your fleet-management reporting. Since exploitation requires social engineering plus a co-installed app, inventory locally installed applications that interact with browser data transfers and remind users to treat drag-and-drop/data-transfer prompts with caution. With no public PoC or in-the-wild exploitation known, patching within your normal update cadence is reasonable, though prioritize for high-risk or privileged users.

Use after free in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)