CVE-2026-87482: Google Chrome iOS Information Disclosure Flaw

CVE-2026-87482 Overview

CVE-2026-87482 is an information disclosure vulnerability in Google Chrome on iOS. The flaw resides in the HttpsUpgrades component and affects Chrome versions prior to 153.0.8010.36. A remote attacker can leak sensitive information by delivering crafted network traffic that triggers cleartext transmission of data intended for secure channels. Chromium classifies the security severity as Medium, and the issue maps to CWE-319: Cleartext Transmission of Sensitive Information.

Critical Impact
An attacker positioned on the network path can intercept sensitive data that should have been protected by HTTPS, undermining the confidentiality guarantees users expect from the HTTPS-Upgrade feature.

Affected Products

Google Chrome on iOS versions prior to 153.0.8010.36
iOS devices running vulnerable Chrome builds with HttpsUpgrades enabled
Deployments relying on Chrome iOS for enterprise browsing

Discovery Timeline

2026-09-09 - CVE-2026-87482 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87482

Vulnerability Analysis

The vulnerability affects the HttpsUpgrades feature in Google Chrome for iOS. HttpsUpgrades automatically attempts to load navigations over HTTPS even when a user types or follows an http:// link. The intent is to reduce cleartext exposure. In vulnerable builds, certain conditions cause the browser to transmit sensitive request data over cleartext HTTP instead of the upgraded HTTPS channel.

An attacker with a network vantage point, such as a rogue Wi-Fi operator or upstream network device, can observe the resulting plaintext traffic. Depending on the request context, disclosed data may include URL paths, query parameters, cookies scoped to insecure origins, or referrer information.

Root Cause

The root cause is improper enforcement of the HTTPS upgrade path in specific navigation or subresource flows on iOS. Data expected to travel over TLS is emitted over an unencrypted HTTP connection. This is a classic instance of CWE-319, where a protective control fails and reverts to the insecure default.

Attack Vector

Exploitation requires the attacker to observe or manipulate network traffic between the victim device and the destination server. Common scenarios include public Wi-Fi networks, compromised routers, and adversary-in-the-middle proxies. No user interaction beyond normal browsing is required, and no authentication on the target service is needed for the attacker to capture disclosed data. See the Chromium Issue Tracker Entry and the Google Chrome Stable Update for vendor-level detail.

No public proof-of-concept or exploit code is available. The EPSS probability is 0.15%, indicating low near-term exploitation likelihood.

Detection Methods for CVE-2026-87482

Indicators of Compromise

Unexpected cleartext HTTP requests from iOS Chrome clients to hosts that support HTTPS.
Chrome User-Agent strings on iOS with versions earlier than 153.0.8010.36 observed in proxy or firewall logs.
Sensitive URL parameters or cookies appearing in plaintext capture data from mobile subnets.

Detection Strategies

Correlate browser version telemetry from mobile device management with Chrome iOS build 153.0.8010.36 to identify unpatched endpoints.
Inspect egress web proxy logs for http:// navigations originating from Chrome iOS to domains that are on HSTS preload or otherwise HTTPS-only.
Alert on anomalous downgrade patterns where the same client alternates between HTTPS and cleartext for the same host.

Monitoring Recommendations

Enable full URL and TLS metadata logging on enterprise web gateways for mobile traffic.
Track Chrome iOS version distribution over time and flag devices that remain on pre-patch builds.
Monitor untrusted network segments, particularly guest and public Wi-Fi, for cleartext requests carrying session cookies or credentials.

How to Mitigate CVE-2026-87482

Immediate Actions Required

Update Google Chrome on iOS to version 153.0.8010.36 or later through the Apple App Store.
Push the update via mobile device management to enforce compliance across managed iOS fleets.
Require corporate mobile users to route traffic through a VPN or trusted egress until patched.

Patch Information

Google addressed the issue in Chrome for iOS 153.0.8010.36. Refer to the Google Chrome Stable Update advisory and the Chromium Issue Tracker Entry for release information. Verify the installed version in Chrome under Settings, About Chrome.

Workarounds

Avoid using Chrome on iOS on untrusted networks until the update is applied.
Use an always-on VPN to encapsulate browser traffic, preventing on-path observation of cleartext requests.
Enforce HSTS preload and HTTPS-only mode on internal web properties to reduce the surface where downgrade can leak data.

bash

# Verify Chrome iOS version compliance via MDM query (conceptual)
# Flag devices where installed Chrome version is below 153.0.8010.36
mdm query --app com.google.chrome.ios --field version \
  | awk '$2 < "153.0.8010.36" {print $1" NEEDS_UPDATE"}'