CVE-2026-87503: Chrome Android Auth Bypass Vulnerability

CVE-2026-87503 Overview

CVE-2026-87503 is an inappropriate implementation flaw in the Downloads component of Google Chrome on Android. Versions prior to 153.0.8010.36 are affected. A remote attacker can leverage social engineering to bypass system access restrictions through a crafted HTML page. The weakness is classified as [CWE-841] (Improper Enforcement of Behavioral Workflow). Chromium rates the underlying issue as Medium severity. Exploitation requires user interaction, which limits mass exploitation but keeps the vulnerability viable in targeted phishing scenarios. No public exploit or in-the-wild abuse has been reported at the time of publication.

Critical Impact
A remote attacker can trick an Android user into interacting with a crafted web page to bypass Chrome's Downloads access restrictions, undermining the integrity of file handling on the device.

Affected Products

Google Chrome on Android prior to 153.0.8010.36
Chromium-based browsers on Android that inherit the vulnerable Downloads implementation
Android endpoints where users install APKs or open downloaded content through Chrome

Discovery Timeline

2026-09-09 - CVE-2026-87503 published to the National Vulnerability Database (NVD)
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87503

Vulnerability Analysis

The flaw resides in the Downloads subsystem of Chrome for Android. The implementation does not correctly enforce the workflow that governs how downloaded content interacts with system access restrictions. An attacker who convinces a user to visit a crafted HTML page can drive the download flow into a state where expected safeguards are skipped. The result is a bypass of restrictions that the operating system and browser normally impose on downloaded files. The vulnerability targets integrity rather than confidentiality, meaning an attacker can influence what content lands on the device without direct data theft.

Root Cause

The root cause is an improper enforcement of the intended behavioral workflow within Chrome's Downloads pipeline on Android. Under specific sequences triggered by attacker-controlled HTML, the browser fails to apply the checks that gate file placement or system interaction. This pattern maps to [CWE-841], where a required step in a state machine can be skipped or reordered. Google addressed the defect in Chrome 153.0.8010.36 through changes tracked in Chromium issue 497986036.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker hosts a crafted HTML page and directs the victim to it through phishing, malvertising, or a compromised site. When the user interacts with the page, for example by tapping a download prompt, the Downloads component follows a flow that skips the intended access checks. The attacker can then place or execute content in a manner that ordinarily would be blocked. Refer to the Chromium Issue #497986036 tracker for additional technical context.

No verified proof-of-concept code is publicly available. See the Google Chrome Stable Update advisory for vendor-supplied detail.

Detection Methods for CVE-2026-87503

Indicators of Compromise

Chrome for Android versions earlier than 153.0.8010.36 present on managed mobile fleets
Unexpected file downloads originating from newly visited or low-reputation domains
APKs or executable content appearing in the device Downloads directory without a corresponding user request
Browser telemetry showing repeated download prompts triggered from a single crafted page

Detection Strategies

Inventory Chrome versions across Android devices using mobile device management (MDM) reporting and flag hosts below 153.0.8010.36
Correlate web proxy logs with endpoint file creation events to identify downloads that bypass expected user prompts
Monitor for URL patterns and referrers associated with known social-engineering campaigns targeting mobile browsers

Monitoring Recommendations

Ingest Chrome update posture and Android download activity into a centralized analytics platform for continuous review
Alert on installation of APKs sourced from Chrome downloads outside approved distribution channels
Track browser crash and error telemetry that may indicate exploitation attempts against the Downloads component

How to Mitigate CVE-2026-87503

Immediate Actions Required

Update Google Chrome on Android to version 153.0.8010.36 or later through the Google Play Store
Enforce automatic browser updates via MDM policy on all managed Android devices
Communicate phishing awareness guidance emphasizing caution with unexpected download prompts in the mobile browser
Restrict installation of applications from unknown sources on corporate Android devices

Patch Information

Google released the fix in the Chrome Stable channel. Users and administrators should upgrade to Chrome 153.0.8010.36 or later on Android. Details are published in the Google Chrome Stable Update release notes, with the underlying defect tracked as Chromium Issue #497986036.

Workarounds

Disable installation of apps from unknown sources in Android settings until patching is complete
Route mobile browser traffic through a filtering proxy that blocks known malicious download hosts
Use an alternative, patched browser for high-risk browsing on unpatched devices
Apply MDM policies that restrict file downloads to approved MIME types where feasible

bash

# Configuration example: enforce Chrome minimum version via Android Enterprise managed configuration
# Set within your MDM's managed app configuration for com.android.chrome
{
  "MinimumVersion": "153.0.8010.36",
  "DownloadRestrictions": 2,
  "URLBlocklist": ["*"],
  "URLAllowlist": ["https://*.corp.example.com/*"]
}