CVE-2026-87545: Google Chrome iOS Information Disclosure

CVE-2026-87545 Overview

CVE-2026-87545 is an information disclosure vulnerability affecting Google Chrome on iOS prior to version 153.0.8010.36. The flaw resides in the Mobile component and allows a remote attacker to leak sensitive information through a crafted HTML page. Exploitation requires user interaction driven by social engineering, such as convincing the target to visit an attacker-controlled site. Google classifies the Chromium security severity as Low, while the National Vulnerability Database (NVD) assigns a CVSS 3.1 base score of 6.5. The weakness is categorized as CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
A remote attacker can extract confidential browser-side data from iOS Chrome users who load a malicious page, undermining browsing session confidentiality.

Affected Products

Google Chrome on iOS prior to 153.0.8010.36
Apple iPhone OS (as the host platform for the affected Chrome build)
Chromium-based Mobile component on iOS

Discovery Timeline

2026-09-09 - CVE-2026-87545 published to NVD
2026-09-09 - Last updated in NVD database
2026-09 - Google publishes Stable Channel update advisory via the Chrome Releases blog

Technical Details for CVE-2026-87545

Vulnerability Analysis

The vulnerability is an information leak within the Mobile component of Google Chrome on iOS. An attacker who controls page content can cause the browser to expose sensitive data that should remain isolated inside the rendering or navigation boundary. Because the attack vector is network-based and requires no privileges, any user who loads the crafted page from Chrome on iOS is a viable target. User interaction is required, which aligns with a social engineering delivery model such as phishing, malvertising, or a lured link in a messaging app. The confidentiality impact is high, while integrity and availability are not affected.

Root Cause

The root cause is improper isolation of sensitive browser state that is reachable from attacker-controlled HTML. Under CWE-200, the Mobile component fails to prevent a crafted page from observing information that crosses the intended trust boundary on iOS builds prior to 153.0.8010.36. Google withheld deeper technical detail pending broad patch adoption, which is standard for Chromium disclosures. Additional context is tracked in the Chromium Issue Tracker entry.

Attack Vector

Exploitation follows a client-side path. The attacker hosts a crafted HTML page and lures an iOS Chrome user to visit it. Once the page loads and the user performs the required interaction, the page triggers the leak and exfiltrates the recovered data over the network to attacker infrastructure. No authentication, elevated privileges, or local access is needed. The Exploit Prediction Scoring System (EPSS) probability is 0.247% (percentile 15.992), and no public proof-of-concept or in-the-wild exploitation has been reported.

No verified exploit code is available. Refer to the Chromium Issue Tracker entry for authoritative technical detail as it is released.

Detection Methods for CVE-2026-87545

Indicators of Compromise

Chrome for iOS clients reporting a version string below 153.0.8010.36 in mobile device management (MDM) telemetry.
Outbound connections from iOS devices to newly registered or low-reputation domains immediately after clicking on links delivered by phishing, SMS, or messaging apps.
HTTP referers showing users navigating from social platforms or email gateways to unfamiliar HTML landing pages that trigger unexpected fetch or beacon traffic.

Detection Strategies

Inventory Chrome for iOS versions across managed devices and flag any build older than 153.0.8010.36.
Correlate web proxy or secure web gateway logs with threat intelligence feeds to identify user visits to known malicious HTML pages.
Hunt for anomalous outbound POST or beacon patterns from mobile user agents identifying as Chrome on iOS shortly after link clicks.

Monitoring Recommendations

Ingest mobile browser version telemetry and network egress logs into a centralized analytics platform for continuous version compliance monitoring.
Alert on repeated user interactions with URLs flagged by phishing detection or URL reputation services.
Track MDM patch compliance dashboards to confirm the Chrome iOS fleet is at or above the patched build.

How to Mitigate CVE-2026-87545

Immediate Actions Required

Update Google Chrome on iOS to version 153.0.8010.36 or later through the Apple App Store on all managed and personal devices.
Push the update through MDM policies and enforce minimum-version compliance for Chrome on iOS.
Reinforce user awareness training focused on not opening unsolicited links delivered by email, SMS, or social media.

Patch Information

Google addressed CVE-2026-87545 in the Chrome Stable Channel update documented in the Chrome Releases advisory. iOS users must install Chrome 153.0.8010.36 or later. The fix removes the information leak in the Mobile component. Additional context is available in the Chromium Issue Tracker entry.

Workarounds

Restrict browsing to trusted domains via an enterprise secure web gateway or DNS filtering service until all devices are patched.
Temporarily route iOS users to a fully patched alternative browser on managed devices where updating Chrome is delayed.
Block known phishing and malvertising infrastructure at the network edge to reduce the likelihood of users reaching a crafted HTML page.

bash

# Example MDM compliance check for Chrome iOS version
# Replace <deviceId> with the target device identifier
mdm-cli query --device <deviceId> \
  --app com.google.chrome.ios \
  --field version \
  --min-version 153.0.8010.36