CVE-2026-87552 Overview
CVE-2026-87552 is a missing authorization vulnerability [CWE-862] in the Trusted Web Activities (TWA) component of Google Chrome on Android. The flaw affects versions prior to Chrome 153.0.8010.36 and allows a co-installed malicious application to obtain sensitive information from Chrome. Google classifies the Chromium security severity as High, while the CVSS v3.1 base score is 5.5.
Exploitation requires local access on the Android device and user interaction, typically through installing and running a companion application. Successful exploitation results in confidentiality impact, exposing browser data that should have been isolated by the TWA authorization model.
Critical Impact
A co-installed Android application can bypass authorization checks in Trusted Web Activities to read sensitive user data handled by Chrome.
Affected Products
- Google Chrome for Android versions prior to 153.0.8010.36
- Google Android devices with vulnerable Chrome installed
- Android applications relying on TWA-integrated Chrome sessions
Discovery Timeline
- 2026-09-09 - CVE-2026-87552 published to the National Vulnerability Database (NVD)
- 2026-09-10 - Last updated in the NVD database
Technical Details for CVE-2026-87552
Vulnerability Analysis
Trusted Web Activities allow Android applications to display web content in a full-screen Chrome-backed session while sharing storage and permissions with a verified web origin. The feature relies on Digital Asset Links and authorization checks to ensure only trusted origins and applications can interact with the browsing session. In vulnerable Chrome builds, an authorization check within the TWA implementation is missing, allowing an unrelated app installed on the same device to interact with a TWA session it should not have access to.
The attacker delivery model is local: a user installs a second Android application alongside Chrome. When the victim launches or interacts with a TWA-enabled activity, the malicious co-installed application can reach protected resources and exfiltrate confidential data. Integrity and availability are not impacted, but confidentiality exposure is high.
Root Cause
The root cause is a missing authorization control [CWE-862] in the TWA request-handling path. The component does not sufficiently verify that the calling Android package is the authorized origin owner before granting access to session-scoped data. This breaks the intended trust boundary between Chrome, the verified TWA origin, and other installed applications.
Attack Vector
The attack requires the adversary to have code execution as an unprivileged app on the target Android device, either through sideloading or through an app installed from a store. User interaction is required, consistent with the UI:R component of the CVSS vector. Once the victim triggers the vulnerable TWA flow, the attacker's co-installed application can query interfaces exposed by Chrome and retrieve information without providing valid authorization. No verified proof-of-concept code is publicly available. See the Chromium Issue Tracker entry #547426657 for further technical details as they become available.
Detection Methods for CVE-2026-87552
Indicators of Compromise
- Unexpected inter-process communication between third-party Android applications and the com.android.chrome package around TWA session launches.
- Newly installed Android applications that request TWA-related intents or declare Digital Asset Links they do not legitimately own.
- Chrome versions on managed Android endpoints reporting build numbers earlier than 153.0.8010.36.
Detection Strategies
- Inventory Chrome versions across the Android fleet using mobile device management (MDM) and flag hosts below 153.0.8010.36.
- Review installed application lists on managed devices for untrusted apps that declare TWA integration or handle Custom Tabs intents.
- Correlate application install events with Chrome telemetry to identify suspicious sequences of installation followed by TWA activity.
Monitoring Recommendations
- Enable MDM compliance rules that enforce a minimum Chrome for Android version and alert on drift.
- Monitor Google Play Protect and endpoint mobile threat defense signals for apps flagged as behaving suspiciously around browser components.
- Track Chrome release channels and subscribe to updates from the Chrome Releases blog to detect future related fixes.
How to Mitigate CVE-2026-87552
Immediate Actions Required
- Update Google Chrome for Android to version 153.0.8010.36 or later on all managed devices.
- Audit installed applications and remove any untrusted or unnecessary apps that could act as co-installed attackers.
- Communicate the risk to end users and instruct them to install applications only from vetted sources.
Patch Information
Google fixed CVE-2026-87552 in Chrome 153.0.8010.36. Details of the release are documented in the Google Chrome stable channel update. Additional engineering context is tracked in the Chromium Issue Tracker #547426657. Enterprises should push the update through Google Play managed distribution or MDM policies to ensure timely deployment.
Workarounds
- Restrict application installation to approved enterprise stores via Android Enterprise policies until patching completes.
- Disable or avoid TWA-based applications on high-risk devices until Chrome is updated to a fixed version.
- Enforce work profile separation so that sensitive browsing occurs in a profile isolated from personal or untrusted apps.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
