CVE-2026-87534: Google Chrome Android Auth Bypass Vulnerability

CVE-2026-87534 Overview

CVE-2026-87534 is a missing authorization vulnerability [CWE-862] in the WebView component of Google Chrome on Android. The flaw affects Chrome versions prior to 153.0.8010.36. A remote attacker who successfully leverages social engineering can bypass system access restrictions by sending crafted network traffic to a vulnerable device. Chromium classifies the security severity as Medium.

The vulnerability requires user interaction, which reduces its exploitability compared with a direct network-facing flaw. However, WebView is embedded across many Android applications, expanding the effective attack surface.

Critical Impact
Remote attackers can bypass access restrictions in Chrome WebView on Android through crafted network traffic combined with social engineering, potentially exposing resources that should remain protected.

Affected Products

Google Chrome for Android prior to 153.0.8010.36
Android applications embedding the vulnerable Chrome WebView component
Chromium-based browsers on Android that inherit the affected WebView code

Discovery Timeline

2026-09-09 - CVE-2026-87534 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87534

Vulnerability Analysis

The issue resides in Chrome's Android WebView implementation. WebView allows applications to render web content in-process using the Chromium engine. A missing authorization check permits a remote attacker to reach functionality or resources that should require an authorization decision.

Because exploitation depends on social engineering, an attacker must convince a user to visit attacker-controlled content or interact with a crafted resource. Once the user engages, the crafted network traffic triggers the code path where the authorization check is absent. The result is a bypass of system access restrictions enforced by WebView.

The EPSS probability is 0.174%, reflecting a low near-term exploitation forecast. The absence of authorization enforcement in a widely deployed browser component nonetheless warrants prompt patching.

Root Cause

The root cause is a missing authorization control [CWE-862] on a code path reachable through WebView. The component processes crafted input without validating that the caller or origin holds the required privileges for the requested action. Details are tracked in Chromium Issue #513134173.

Attack Vector

An attacker hosts crafted content or delivers crafted network traffic to a target user. Social engineering, such as a phishing link or a malicious in-app link, is required to drive the user into loading the payload in WebView. Once loaded, the crafted traffic exercises the vulnerable path and bypasses the intended access restriction.

No public proof-of-concept exploit is currently available. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Google Chrome release notes for the vendor announcement.

Detection Methods for CVE-2026-87534

Indicators of Compromise

Android devices running Chrome or WebView versions below 153.0.8010.36 connecting to untrusted domains delivered through phishing.
Unusual WebView-initiated network requests to resources that should be gated behind system access controls.
User reports of unexpected content rendering, prompts, or redirects inside embedded WebView surfaces.

Detection Strategies

Inventory Android endpoints and enumerate installed Chrome and Android System WebView versions. Flag any build older than 153.0.8010.36.
Inspect mobile proxy or DNS telemetry for repeated user redirects that culminate in WebView loads of low-reputation domains.
Correlate phishing email or messaging telemetry with subsequent WebView activity from the same user or device.

Monitoring Recommendations

Enable mobile threat defense telemetry to record WebView version, package origin, and outbound domains.
Alert on Android devices that fail to pull the current Chrome stable channel within your patch SLA.
Track access attempts against sensitive internal resources originating from mobile user agents that identify as pre-patch Chrome builds.

How to Mitigate CVE-2026-87534

Immediate Actions Required

Update Google Chrome on Android to version 153.0.8010.36 or later through the Google Play Store.
Update the Android System WebView package on all managed devices, since apps embedding WebView inherit the fix.
Enforce automatic updates for Chrome and WebView through mobile device management policy.

Patch Information

Google addressed the issue in Chrome for Android 153.0.8010.36. Refer to the Google Chrome stable channel update and Chromium Issue #513134173 for release details. Ensure both the Chrome app and the Android System WebView system component are updated on each device.

Workarounds

Restrict use of Chrome on Android and Chromium-based browsers until patched builds are deployed enterprise-wide.
Deliver targeted user awareness communications warning against following unsolicited links on mobile devices.
Apply network-level filtering to block known malicious domains and reduce exposure to social engineering payloads.

bash

# Verify installed Chrome and WebView versions on a managed Android device
adb shell dumpsys package com.android.chrome | grep versionName
adb shell dumpsys package com.google.android.webview | grep versionName