CVE-2026-87463: Google Chrome Auth Bypass Vulnerability

CVE-2026-87463 Overview

CVE-2026-87463 is an incorrect authorization vulnerability [CWE-863] in the Certificate component of Google Chrome on Android. Versions prior to 153.0.8010.36 are affected. A remote attacker can send crafted network traffic to potentially spoof the address bar in the Chrome browser. Chromium security assigned this issue a Low internal severity rating.

The vulnerability requires no authentication and no user interaction, but exploitation complexity is high. Successful exploitation undermines the trust indicators users rely on to verify the identity of a website, enabling downstream phishing and credential theft scenarios.

Critical Impact
Address bar spoofing allows attackers to display a trusted URL while serving attacker-controlled content, breaking the primary visual trust boundary in the mobile browser.

Affected Products

Google Chrome on Android prior to 153.0.8010.36
Google Android devices running vulnerable Chrome builds
Chromium-derived browsers on Android inheriting the affected certificate handling logic

Discovery Timeline

2026-09-09 - CVE-2026-87463 published to NVD
2026-09-09 - Last updated in NVD database
2026-09 - Google releases fixed Chrome stable channel build 153.0.8010.36

Technical Details for CVE-2026-87463

Vulnerability Analysis

The flaw resides in the Certificate handling logic within Chrome for Android. Incorrect authorization checks allow the browser to render an address bar state that does not accurately reflect the true origin of the loaded content. An attacker who controls network traffic delivered to the browser can trigger this inconsistency.

The impact centers on integrity of the user interface rather than direct code execution. Because mobile address bars are already constrained in screen real estate, spoofing on Android carries elevated phishing utility. Users typically rely on the visible origin to distinguish legitimate services from imposters.

Root Cause

The vulnerability is classified as CWE-863: Incorrect Authorization. The Certificate component evaluates trust and origin state under conditions that permit inconsistent decisions between the network stack and the URL bar renderer. The mismatch enables the browser to associate an attacker-controlled response with a URL the attacker did not legitimately serve.

See the Chromium Issue Tracker entry for upstream technical discussion.

Attack Vector

Exploitation occurs over the network without user interaction. The attacker must be positioned to deliver crafted traffic to the victim browser, for example through a hostile network path, a compromised upstream service, or a malicious site that induces specific navigation sequences. The crafted traffic causes the browser to render a spoofed origin in the address bar while displaying attacker content.

No verified proof-of-concept code is publicly available for CVE-2026-87463. See the Chrome Stable Channel Update for vendor details.

Detection Methods for CVE-2026-87463

Indicators of Compromise

Mobile Chrome clients reporting versions earlier than 153.0.8010.36 in user-agent telemetry
Anomalous TLS or HTTP response patterns targeting mobile Chrome sessions from untrusted network paths
User reports of address bar content that does not match the page loaded

Detection Strategies

Inventory managed Android fleets for Chrome versions below 153.0.8010.36 using mobile device management (MDM) telemetry
Correlate phishing report volume against sessions originating from vulnerable Chrome builds on Android
Inspect proxy and secure web gateway logs for certificate anomalies and unexpected origin transitions in mobile browser sessions

Monitoring Recommendations

Track Chrome version distribution across managed Android endpoints and flag devices that do not upgrade within the patch window
Monitor identity provider logs for credential submissions preceded by suspicious navigation patterns from Android Chrome clients
Alert on repeated user-submitted phishing tickets referencing legitimate-looking URLs

How to Mitigate CVE-2026-87463

Immediate Actions Required

Update Google Chrome on Android to version 153.0.8010.36 or later through the Google Play Store
Push a forced Chrome update policy through MDM to accelerate remediation on managed Android devices
Communicate to users that the mobile address bar may not always reflect the true origin on unpatched builds and reinforce phishing reporting procedures

Patch Information

Google addressed the vulnerability in Chrome stable channel build 153.0.8010.36 for Android. Refer to the Chrome Release Update for the official advisory and release notes. Chromium-derivative browser vendors should merge the upstream fix and ship an equivalent update to their Android users.

Workarounds

Restrict use of Google Chrome on Android for accessing sensitive applications until the update is installed
Route mobile browser traffic through an enterprise secure web gateway that enforces certificate validation and blocks suspicious origins
Require phishing-resistant authentication such as FIDO2 or passkeys so that spoofed address bars alone cannot yield usable credentials

bash

# Verify Chrome version on a managed Android device via ADB
adb shell dumpsys package com.android.chrome | grep versionName

# Expected output on a patched device:
# versionName=153.0.8010.36