CVE-2026-87555: Google Chrome Information Disclosure Flaw

CVE-2026-87555 Overview

CVE-2026-87555 is an uninitialized resource vulnerability [CWE-908] in the GPU component of Google Chrome on Android. Versions prior to 153.0.8010.36 are affected. A remote attacker can read memory outside the Chrome sandbox by serving a crafted HTML page to a targeted user. Google classifies the Chromium security severity as Medium.

The flaw exposes sensitive process memory that should remain isolated by the sandbox boundary. Exploitation requires user interaction, specifically loading attacker-controlled web content in the vulnerable browser. Successful exploitation reveals memory contents but does not directly enable code execution or data modification.

Critical Impact
Remote attackers can read memory outside the Chrome sandbox on Android devices by luring users to a crafted HTML page, potentially leaking sensitive process data.

Affected Products

Google Chrome for Android versions prior to 153.0.8010.36
Google Android devices running vulnerable Chrome builds
Chromium-based browsers on Android that share the affected GPU code path

Discovery Timeline

2026-09-09 - CVE-2026-87555 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87555

Vulnerability Analysis

The vulnerability resides in the GPU process of Google Chrome on Android. A resource inside the GPU pipeline is used before it is fully initialized, causing residual memory contents to be exposed to the caller. This class of defect is tracked under Common Weakness Enumeration [CWE-908], Use of Uninitialized Resource.

Because the GPU process handles rendering data from web content, an attacker-controlled HTML page can trigger the affected code path. The leaked bytes originate from memory regions that sit outside the renderer sandbox. Disclosed content may include pointers, session tokens, or other cross-origin data.

The issue impacts confidentiality only. Integrity and availability are not directly affected, and the attacker cannot escape the sandbox using this bug alone. However, leaked pointers can weaken address space layout randomization (ASLR) and support chained exploitation with other vulnerabilities.

Root Cause

The root cause is a GPU resource allocated without being zero-initialized before use. When Chrome reads back or returns that resource to a caller reachable from web content, uninitialized bytes are exposed. Details are tracked in Chromium Issue #517337579.

Attack Vector

The attacker hosts a crafted HTML page that exercises the vulnerable GPU code path. A user must visit the page in a vulnerable Chrome for Android build. No authentication or elevated privileges are required on the target device. The scope changes from the renderer to the GPU process, allowing the leak to cross a trust boundary.

No public proof-of-concept exploit is available at time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Chrome Stable Channel Update for vendor advisory details.

Detection Methods for CVE-2026-87555

Indicators of Compromise

Android devices running Chrome versions earlier than 153.0.8010.36 connecting to unfamiliar or newly registered domains that host complex WebGL or GPU-heavy content.
Browser telemetry showing repeated GPU process crashes or anomalous GPU workload patterns following visits to untrusted sites.
Outbound requests from mobile endpoints to attacker-controlled infrastructure delivering HTML pages with unusual canvas, WebGL, or WebGPU payloads.

Detection Strategies

Inventory Chrome for Android versions across managed mobile devices and flag any build below 153.0.8010.36.
Correlate mobile browsing telemetry with threat intelligence to identify visits to domains associated with browser exploitation kits.
Monitor mobile device management (MDM) reports for delayed Chrome updates on enrolled Android devices.

Monitoring Recommendations

Track Chrome version distribution weekly and alert on devices that lag more than one stable release behind.
Ingest mobile web proxy logs into a centralized analytics platform to identify anomalous HTML delivery patterns.
Enable crash telemetry collection from Chrome and investigate clusters of GPU process crashes on Android endpoints.

How to Mitigate CVE-2026-87555

Immediate Actions Required

Update Google Chrome on Android to version 153.0.8010.36 or later through the Google Play Store.
Push the update through MDM to any managed Android fleet and confirm installation on all devices.
Advise users to avoid clicking untrusted links on mobile devices until the patch is applied.

Patch Information

Google released the fix in the Chrome stable channel referenced in the Chrome Stable Channel Update. Upgrading Chrome for Android to 153.0.8010.36 or later remediates CVE-2026-87555. The upstream Chromium fix is tracked in Chromium Issue #517337579.

Workarounds

Restrict use of Chrome for Android on high-value accounts until the patched build is deployed.
Use enterprise browsing policies to block navigation to uncategorized or newly registered domains from mobile devices.
Disable hardware acceleration in Chrome flags where operationally acceptable to reduce exposure to the GPU code path.

bash

# Verify installed Chrome version on an Android device via ADB
adb shell dumpsys package com.android.chrome | grep versionName

# Expected output on patched devices:
# versionName=153.0.8010.36