CVE-2026-87565: Google Chrome Information Disclosure Flaw

CVE-2026-87565 Overview

CVE-2026-87565 is an information disclosure vulnerability in the Passwords component of Google Chrome on Android. Versions prior to 153.0.8010.36 allow a remote attacker to leak sensitive information through a crafted HTML page. The flaw is categorized under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor). Exploitation requires user interaction, such as visiting an attacker-controlled web page. Google's Chromium team rated the underlying security severity as Low, while the NVD assigned a medium CVSS score reflecting the high confidentiality impact.

Critical Impact
A remote attacker can leak sensitive password-related information from Chrome on Android by luring a user to a crafted HTML page.

Affected Products

Google Chrome on Android prior to 153.0.8010.36
Google Android (as the underlying platform for the affected Chrome build)
Chromium-based components sharing the vulnerable Passwords module

Discovery Timeline

2026-09-09 - CVE-2026-87565 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87565

Vulnerability Analysis

The vulnerability resides in the Passwords subsystem of Google Chrome on Android. A remote attacker can craft an HTML page that triggers unintended exposure of sensitive password-related data handled by the browser. Because Chrome's Passwords component manages saved credentials, autofill behavior, and related metadata, any leak in this surface risks disclosing user secrets to attacker-controlled origins. The issue is tracked in Chromium as Issue 532968511 and resolved in Chrome for Android version 153.0.8010.36, per the Google Chrome Stable Update. No public proof-of-concept has been released, and there is no evidence of exploitation in the wild.

Root Cause

The defect is classified as [CWE-200], indicating that the Passwords component exposes data to actors who should not have access. The advisory does not disclose implementation-level details, but the impact vector points to improper isolation between attacker-supplied web content and the browser's stored credential state on Android.

Attack Vector

Exploitation is remote and requires user interaction. An attacker hosts a crafted HTML page and lures a Chrome Android user to load it. Once rendered, the page abuses the Passwords logic to observe or exfiltrate sensitive information. No authentication or elevated privileges are required on the target device.

No verified exploit code is available. Refer to the Chromium Issue Tracker entry once Google unrestricts the ticket for full technical details.

Detection Methods for CVE-2026-87565

Indicators of Compromise

Chrome for Android clients reporting a version earlier than 153.0.8010.36 in mobile device management inventory.
Mobile browser sessions loading unfamiliar HTML pages immediately followed by outbound requests carrying encoded credential-like strings.
User reports of unexpected password autofill prompts or credential exposure after visiting an untrusted link.

Detection Strategies

Inventory Chrome for Android versions across managed mobile fleets and flag any build below 153.0.8010.36.
Correlate mobile web proxy logs with threat intelligence feeds to identify visits to suspicious or newly registered domains delivering crafted HTML.
Monitor for anomalous credential reuse patterns on enterprise services accessed from mobile devices, which may indicate leaked passwords.

Monitoring Recommendations

Enable telemetry from mobile threat defense and MDM platforms to track Chrome version compliance in real time.
Alert on outbound HTTPS POSTs from mobile user agents containing unusually large form payloads to non-corporate destinations.
Track authentication anomalies such as impossible-travel logins or credential-stuffing patterns tied to users of unpatched Chrome Android builds.

How to Mitigate CVE-2026-87565

Immediate Actions Required

Update Google Chrome on Android to version 153.0.8010.36 or later through the Google Play Store.
Enforce a minimum Chrome version policy via mobile device management and block launch of outdated builds.
Advise users to avoid clicking untrusted links and to disable autofill for sensitive corporate credentials until patching is confirmed.

Patch Information

Google addressed the issue in Chrome 153.0.8010.36 for Android. Details are documented in the Google Chrome Stable Channel Update and the Chromium Issue Tracker #532968511. Confirm rollout completion across managed devices before closing remediation tickets.

Workarounds

Restrict use of Chrome on Android for high-value accounts until patched builds are deployed fleet-wide.
Rotate credentials for users who visited suspicious sites while running a vulnerable Chrome version.
Deploy DNS or secure web gateway filtering on mobile devices to block known malicious domains that may host crafted HTML payloads.

bash

# Query Chrome for Android version compliance via ADB
adb shell dumpsys package com.android.chrome | grep versionName

# Example MDM policy snippet (Android Enterprise managed configuration)
# Enforce minimum Chrome version 153.0.8010.36
{
  "MinimumVersion": "153.0.8010.36",
  "PasswordManagerEnabled": false
}