CVE-2026-87483: Google Chrome Android Auth Bypass Flaw

CVE-2026-87483 Overview

CVE-2026-87483 is an incorrect authorization vulnerability in the Browser component of Google Chrome on Android versions prior to 153.0.8010.36. A remote attacker can bypass system access restrictions by tricking a user into loading a crafted HTML page. The flaw is categorized under [CWE-863: Incorrect Authorization] and rated Medium severity by the Chromium security team.

Successful exploitation requires user interaction, typically visiting an attacker-controlled webpage. The vulnerability affects the integrity of system-level access controls enforced by the browser on Android devices.

Critical Impact
A remote attacker can bypass system access restrictions on Android Chrome by delivering a crafted HTML page to a targeted user.

Affected Products

Google Chrome for Android versions prior to 153.0.8010.36
Android devices running vulnerable Chrome builds
Chromium-based browsers on Android that share the affected code path

Discovery Timeline

2026-09-09 - CVE-2026-87483 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87483

Vulnerability Analysis

The vulnerability resides in the Browser process of Google Chrome on Android. Chrome enforces authorization checks before granting webpages access to certain system-level capabilities. In affected versions, these checks are performed incorrectly, allowing a crafted HTML page to bypass restrictions that should isolate untrusted web content from privileged system access.

The issue is tracked as Chromium Issue #520201931 and was fixed in the Chrome Stable channel update announced on the Chrome Releases Blog.

Root Cause

The root cause is an incorrect authorization decision in the Browser component. The authorization logic fails to properly validate the origin or permission state before allowing an operation that should be gated by system-level access restrictions. This maps to [CWE-863], where a user is granted access to resources or actions they should not be permitted to invoke.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker hosts a crafted HTML page and lures a target user of vulnerable Chrome on Android to visit it. When the page loads, the malicious content invokes the affected code path and bypasses the intended system access restriction. No authentication is required on the target device, and the attack does not require chained privilege escalation to succeed against the integrity boundary.

No public proof-of-concept exploit has been published for this vulnerability. Technical specifics remain restricted in the Chromium issue tracker pending broad patch adoption.

Detection Methods for CVE-2026-87483

Indicators of Compromise

Android devices running Chrome versions earlier than 153.0.8010.36 after the patch release date
Chrome browser telemetry showing navigation to unfamiliar domains immediately preceding unexpected permission or system access events
Mobile device management (MDM) inventory reports flagging outdated Chrome builds on managed Android endpoints

Detection Strategies

Inventory managed Android devices and correlate installed Chrome versions against the fixed build 153.0.8010.36 or later
Monitor mobile web proxy or DNS logs for user navigation to suspicious domains hosting crafted HTML payloads
Review Android application logs for anomalous permission grants or system access requests originating from the Chrome process

Monitoring Recommendations

Enable continuous version compliance reporting through your MDM or unified endpoint management platform
Ingest mobile browsing telemetry into a central analytics platform to correlate URL visits with subsequent device behavior
Track Chrome auto-update health on Android fleets and alert when devices remain on outdated versions beyond a defined SLA

How to Mitigate CVE-2026-87483

Immediate Actions Required

Update Google Chrome on all Android devices to version 153.0.8010.36 or later through the Google Play Store
Push forced updates through MDM policies to managed Android fleets that do not auto-update promptly
Communicate to end users the need to restart Chrome after updating to ensure the new binary is loaded

Patch Information

Google addressed CVE-2026-87483 in Chrome for Android version 153.0.8010.36. Refer to the Chrome Releases Blog announcement for the stable channel update details and to Chromium Issue #520201931 for the tracked fix.

Workarounds

Restrict use of Chrome on Android to trusted sites via web content filtering until the patch is deployed
Use MDM policies to block installation of untrusted APKs and browser extensions that could deliver malicious HTML
Advise users to avoid clicking links from unknown senders in email, SMS, and messaging applications on Android

bash

# Verify Chrome for Android version via ADB on a managed device
adb shell dumpsys package com.android.chrome | grep versionName

# Expected output on a patched device:
# versionName=153.0.8010.36