CVE-2026-87595: Google Chrome Mobile SSRF Vulnerability

CVE-2026-87595 Overview

CVE-2026-87595 is a Server-Side Request Forgery (SSRF) vulnerability in the Mobile component of Google Chrome. The flaw affects Chrome versions prior to 153.0.8010.36. A remote attacker leveraging social engineering can bypass system access restrictions through a crafted HTML page. Chromium classifies the security severity as Low.

The vulnerability is tracked as CWE-918: Server-Side Request Forgery. Successful exploitation requires user interaction, typically luring a victim to a malicious web page. The issue was addressed in the Chrome Stable Channel update that released version 153.0.8010.36.

Critical Impact
A remote attacker who convinces a user to visit a crafted HTML page can bypass system access restrictions in Chrome Mobile, potentially reaching resources normally protected by browser or system boundaries.

Affected Products

Google Chrome Mobile prior to 153.0.8010.36
Chromium-based mobile browsers incorporating the vulnerable code path
Downstream distributions bundling pre-patch Chrome Mobile builds

Discovery Timeline

2026-09-09 - CVE-2026-87595 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87595

Vulnerability Analysis

The vulnerability resides in the Mobile component of Google Chrome and is classified as Server-Side Request Forgery (CWE-918). Chrome fails to properly validate or restrict request destinations initiated on behalf of content loaded from a crafted HTML page. As a result, an attacker can cause the browser to issue requests that bypass system access restrictions the platform would otherwise enforce.

Exploitation requires social engineering. The victim must be persuaded to load attacker-controlled HTML in a vulnerable Chrome Mobile build. Once loaded, the crafted page triggers the SSRF condition without needing additional privileges. Google has addressed the issue in Chrome 153.0.8010.36 on the Stable channel.

Root Cause

The root cause is insufficient enforcement of request origin and destination policies within the Mobile component. Chrome permits network requests that reach targets protected by system-level access restrictions. Without adequate destination filtering, the browser acts as a confused deputy on behalf of remote content. Refer to the Chromium Issue Tracker #513726466 for engineering details when it becomes public.

Attack Vector

The attack vector is remote and browser-based, gated by user interaction. An attacker hosts a crafted HTML page and directs a victim to it through phishing, malvertising, or a compromised site. When the victim opens the page in a vulnerable Chrome Mobile build, the embedded content coerces the browser into issuing requests that cross intended access boundaries. See the Chrome Stable Channel Update for release information.

No public exploit code, proof of concept, or CISA KEV listing has been associated with this CVE at the time of publication.

Detection Methods for CVE-2026-87595

Indicators of Compromise

Chrome Mobile clients on versions earlier than 153.0.8010.36 generating outbound requests to internal or otherwise access-restricted endpoints.
Web traffic to newly registered or low-reputation domains hosting HTML pages that immediately trigger cross-origin or internal network requests.
Unusual browser-originated requests to metadata services, loopback addresses, or link-local IP ranges from mobile devices.

Detection Strategies

Inventory browser versions across managed mobile fleets and flag Chrome builds below 153.0.8010.36 for prioritized remediation.
Inspect web proxy and DNS logs for browser-initiated requests to internal RFC1918, loopback (127.0.0.0/8), or link-local (169.254.0.0/16) destinations following external navigation events.
Correlate phishing-related URL clicks in email or messaging telemetry with subsequent anomalous outbound HTTP requests from the same device.

Monitoring Recommendations

Ingest mobile browser telemetry and web gateway logs into a centralized analytics platform to enable cross-source correlation.
Alert on repeated outbound requests from mobile user agents targeting sensitive internal services or cloud metadata endpoints.
Track user-agent strings and Chrome version headers to identify hosts still running vulnerable builds after the patch window.

How to Mitigate CVE-2026-87595

Immediate Actions Required

Update Google Chrome Mobile to version 153.0.8010.36 or later on all managed devices.
Verify enterprise mobile management policies enforce automatic browser updates and block sideloaded, out-of-date Chrome builds.
Reinforce user awareness training on social engineering, given that exploitation requires the victim to open a crafted HTML page.

Patch Information

Google released the fix in the Chrome Stable channel. Upgrade to Chrome 153.0.8010.36 or later. Details are available in the Chrome Stable Channel Update and the Chromium Issue Tracker #513726466.

Workarounds

Restrict access to sensitive internal endpoints from mobile network segments where browser traffic originates, reducing SSRF impact.
Deploy egress filtering that denies browser-originated requests to internal management interfaces, cloud metadata services, and link-local addresses.
Use enterprise browser policies or MDM controls to limit navigation to attacker-controlled URLs through URL filtering categories.

bash

# Verify Chrome Mobile version compliance via MDM query
# Example: mark devices as non-compliant when Chrome build is below the patched release
MIN_VERSION="153.0.8010.36"
CURRENT_VERSION="$(mdm-query --app com.android.chrome --field versionName)"
if [ "$(printf '%s\n' "$MIN_VERSION" "$CURRENT_VERSION" | sort -V | head -n1)" != "$MIN_VERSION" ]; then
  echo "NON_COMPLIANT: Chrome $CURRENT_VERSION < $MIN_VERSION - CVE-2026-87595"
fi