CVE-2026-87486: Chrome Android Clickjacking Vulnerability

CVE-2026-87486 Overview

CVE-2026-87486 is a clickjacking vulnerability in the Trusted Web Activities (TWA) component of Google Chrome on Android. Versions prior to 153.0.8010.36 allow a local attacker with a co-installed malicious application to spoof the Chrome address bar. The flaw is categorized under [CWE-1021: Improper Restriction of Rendered UI Layers or Frames]. Google's Chromium security team rated the issue as Medium severity. The vulnerability requires a companion Android application on the same device, limiting the attack to local scenarios rather than remote exploitation.

Critical Impact
A co-installed Android application can spoof the Chrome address bar through Trusted Web Activities, enabling phishing scenarios where users cannot reliably verify the origin of displayed content.

Affected Products

Google Chrome for Android prior to 153.0.8010.36
Android applications embedding Chrome via Trusted Web Activities
Devices with co-installed applications leveraging the TWA API

Discovery Timeline

2026-09-09 - CVE-2026-87486 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87486

Vulnerability Analysis

Trusted Web Activities allow Android applications to launch a full-screen Chrome instance that renders web content associated with a verified origin. The mechanism is intended to give developers a native app shell around a Progressive Web App while preserving Chrome's security guarantees. In vulnerable Chrome builds, the TWA rendering path did not adequately restrict how a co-installed application could overlay or manipulate the browser's user interface. This creates a user-interface redress condition where the visible address bar does not correspond to the actual origin serving the content. The result is a spoofing primitive useful for credential phishing, session token capture through fake login pages, or delivery of misleading security prompts.

Root Cause

The root cause is improper restriction of rendered UI layers within the Trusted Web Activities integration. Chrome relied on trust assumptions about the calling Android application without preventing the app from producing a display state that misrepresents the loaded origin. This corresponds to [CWE-1021], the standard weakness class for clickjacking and UI redressing.

Attack Vector

Exploitation requires local access through a co-installed Android application. The attacker publishes or sideloads an app that invokes a Trusted Web Activity and manipulates the visible chrome to display an attacker-chosen URL in the address bar. The user then interacts with content believing it originates from the spoofed domain. No network-adjacent position or elevated privileges are required beyond installing the malicious companion app. See the Chromium Issue Tracker entry #514017067 and the Google Chrome Stable Update announcement for vendor detail.

Detection Methods for CVE-2026-87486

Indicators of Compromise

Android applications that request Trusted Web Activity intents but are not associated with a verified Digital Asset Links declaration.
Chrome installations on Android reporting a version earlier than 153.0.8010.36 in enterprise inventory data.
User reports of unexpected login prompts or address bar content that does not match the app being used.

Detection Strategies

Inventory Chrome for Android versions across managed mobile devices and flag builds prior to 153.0.8010.36.
Audit installed Android packages for applications that declare android.support.customtabs.trusted.TRUSTED_WEB_ACTIVITY handlers from unverified publishers.
Correlate mobile threat defense telemetry for sideloaded APKs installed alongside Chrome updates.

Monitoring Recommendations

Enable managed Google Play policies to restrict installation of applications from unknown sources.
Monitor mobile device management (MDM) reports for Chrome version drift on Android endpoints.
Track user-reported phishing incidents that reference native Android app launches into Chrome.

How to Mitigate CVE-2026-87486

Immediate Actions Required

Update Google Chrome for Android to version 153.0.8010.36 or later through the Google Play Store.
Enforce automatic Chrome updates for managed Android devices via enterprise mobility management policies.
Remove untrusted Android applications that invoke Trusted Web Activities from corporate devices.

Patch Information

Google released the fix in the Chrome stable channel version 153.0.8010.36. Details are published in the Google Chrome Stable Update release notes and tracked under Chromium Issue #514017067. Users on Android should upgrade through Google Play; enterprise fleets should push the update through their MDM platform.

Workarounds

Restrict installation of Android applications to vetted sources such as managed Google Play.
Disable or block Android applications that embed web content through Trusted Web Activities until patched Chrome is deployed.
Instruct users to verify sensitive actions in a standalone Chrome session rather than through an in-app browser experience.

bash

# Verify Chrome for Android version via ADB on a test device
adb shell dumpsys package com.android.chrome | grep versionName
# Expected output on a patched device:
# versionName=153.0.8010.36