CVE-2026-87597 Overview
CVE-2026-87597 is a user interface (UI) misrepresentation vulnerability affecting the CustomTabs component in Google Chrome on Android versions prior to 153.0.8010.36. The flaw allows a remote attacker to spoof the address bar through a co-installed malicious application. Successful exploitation can mislead users into trusting attacker-controlled content that appears to originate from a legitimate origin. Chromium classifies the underlying security severity as Low, and the flaw is tracked under CWE-451: User Interface (UI) Misrepresentation of Critical Information. Google addressed the issue in the Stable Channel update for Chrome on Android.
Critical Impact
Attackers with a co-installed Android app can spoof the Chrome address bar in CustomTabs, enabling convincing phishing and credential-harvesting scenarios.
Affected Products
- Google Chrome for Android prior to version 153.0.8010.36
- Google Android devices with vulnerable Chrome CustomTabs implementation
- Applications embedding Chrome CustomTabs on affected Android versions
Discovery Timeline
- 2026-09-09 - CVE-2026-87597 published to the National Vulnerability Database (NVD)
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-87597
Vulnerability Analysis
The vulnerability resides in Chrome's CustomTabs feature on Android. CustomTabs allow third-party applications to render web content inside a lightweight Chrome-hosted browser surface while displaying the current origin in the address bar. The flaw permits a co-installed application to manipulate the rendered UI so the address bar reflects information inconsistent with the actual loaded resource. The attack requires network delivery of malicious content but no direct user interaction beyond normal browsing within the CustomTab. This class of issue is categorized as UI misrepresentation (CWE-451).
Root Cause
The root cause is insufficient enforcement of trust boundaries between a hosting Android application and the CustomTabs UI surface rendered by Chrome. A co-installed app can influence how origin information is presented, breaking the assumption that the address bar always reflects the authoritative origin of the displayed content. The Chromium Issue Tracker entry 533018632 contains additional implementation details.
Attack Vector
An attacker must convince a user to install a companion Android application on the same device as a vulnerable Chrome build. Once co-installed, the malicious app can launch or interact with a CustomTab in a way that misrepresents the address bar to the user. The victim then perceives attacker-controlled content as originating from a trusted domain. Typical follow-on abuse includes credential phishing, session token capture, and one-time password (OTP) interception. No memory corruption or code execution occurs; the impact is limited to user deception and integrity of displayed origin information.
No public proof-of-concept exploit code is available. The vulnerability is described in prose only; refer to the Chromium Issue Tracker Entry for technical specifics.
Detection Methods for CVE-2026-87597
Indicators of Compromise
- Installation of unknown or untrusted Android applications requesting the ability to open web content via CustomTabs.
- User reports of phishing pages that appear to originate from legitimate domains inside Chrome CustomTab sessions.
- Outbound network traffic from Android devices to newly registered or typosquatted domains shortly after CustomTab launches.
Detection Strategies
- Inventory Chrome for Android versions across managed devices and flag any build earlier than 153.0.8010.36.
- Correlate Android application install events with subsequent CustomTab-based browsing behavior in Mobile Threat Defense (MTD) telemetry.
- Hunt for suspicious Intent invocations from third-party apps that launch CustomTabs targeting sensitive login URLs.
Monitoring Recommendations
- Enable Google Play Protect and enforce enterprise app-vetting policies through Mobile Device Management (MDM).
- Monitor authentication logs for anomalous logins from mobile user agents following credential-entry events on unfamiliar domains.
- Track user-reported phishing incidents and pivot on the referring Android application package name.
How to Mitigate CVE-2026-87597
Immediate Actions Required
- Update Google Chrome on Android to version 153.0.8010.36 or later via the Google Play Store.
- Audit installed Android applications and remove any untrusted apps that request browser or Intent interception capabilities.
- Communicate the phishing risk to end users, particularly around verifying the domain before entering credentials in a CustomTab.
Patch Information
Google released the fix in the Chrome Stable Channel update documented in the Google Chrome Stable Update advisory. Deploy Chrome 153.0.8010.36 or later to all Android endpoints. Enterprise administrators using managed Google Play should push the updated Chrome build through MDM to accelerate coverage.
Workarounds
- Restrict installation of non-Play Store applications through MDM policy until Chrome is updated.
- Configure enterprise browsers to open authentication URLs in the full Chrome browser rather than CustomTabs where possible.
- Educate users to long-press the CustomTab address bar to view full URL details before submitting credentials.
# Example: Verify Chrome version on an Android device via ADB
adb shell dumpsys package com.android.chrome | grep versionName
# Expected output on a patched device:
# versionName=153.0.8010.36
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
