CVE-2026-87600: Google Chrome Android Auth Bypass Flaw

CVE-2026-87600 Overview

CVE-2026-87600 is an improper input validation vulnerability [CWE-20] in the Safe Browsing component of Google Chrome on Android. Versions prior to 153.0.8010.36 are affected. A remote attacker can bypass system access restrictions by delivering a crafted HTML page and leveraging social engineering to trick the user into interaction. Chromium rates the security severity as Medium. The flaw affects the integrity boundary that Safe Browsing enforces between web content and system-level access on Android devices.

Critical Impact
A remote attacker can bypass Safe Browsing access restrictions on Android through a crafted HTML page combined with user interaction, undermining protections that block navigation to malicious or restricted resources.

Affected Products

Google Chrome on Android prior to 153.0.8010.36
Chromium-based mobile browsers sharing the affected Safe Browsing code path
Android devices running vulnerable Chrome Stable channel builds

Discovery Timeline

2026-09-09 - CVE-2026-87600 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87600

Vulnerability Analysis

The vulnerability resides in the Safe Browsing subsystem of Google Chrome for Android. Safe Browsing is responsible for checking navigations, downloads, and other resource requests against known-bad lists and heuristic classifiers. Improper input validation in this component allows a crafted HTML page to bypass system access restrictions when a user is guided through specific interactions.

Exploitation requires user interaction, consistent with a social engineering workflow. The attacker hosts or delivers a malicious HTML page and convinces the victim to perform an action that triggers the vulnerable code path. Successful exploitation impacts integrity by circumventing Safe Browsing's enforcement logic, while confidentiality and availability are not directly affected. Full technical details are tracked in Chromium Issue #517339356.

Root Cause

The root cause is improper input validation [CWE-20] in Safe Browsing input handling on Android. The component fails to correctly sanitize or validate attributes of attacker-controlled HTML content, allowing that content to reach a decision path that should have been blocked. Google has not published low-level implementation details, in line with standard Chromium disclosure practice.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker delivers a crafted HTML page through phishing, malvertising, or a compromised site. When the victim loads the page and completes the attacker-directed action, Safe Browsing fails to enforce the expected access restriction, and the attacker gains an unauthorized capability on the Android device. No authentication is required, and complexity is low. See the Google Chrome Stable Channel Update for release information.

No verified public exploit code or proof-of-concept has been released for this CVE.

Detection Methods for CVE-2026-87600

Indicators of Compromise

Chrome for Android clients running versions below 153.0.8010.36 observed browsing unfamiliar or newly registered domains hosting HTML content that triggers repeated Safe Browsing decisions
User reports of Safe Browsing warnings being absent or dismissed on pages later flagged as malicious
Web proxy or DNS logs showing navigation to URLs associated with phishing kits immediately preceding anomalous mobile activity

Detection Strategies

Inventory mobile Chrome versions across managed Android fleets and flag devices below 153.0.8010.36
Correlate mobile browsing telemetry with threat intelligence feeds identifying Safe Browsing bypass campaigns
Alert on user interaction patterns consistent with social engineering pages, such as forced prompts, fake system dialogs, or overlay UI

Monitoring Recommendations

Enable mobile threat defense telemetry for Chrome on managed Android endpoints
Monitor enterprise web gateways for HTML pages containing scripts that manipulate Safe Browsing verdicts or resource requests
Track EPSS movement for CVE-2026-87600 (currently 0.22%, percentile 12.5) to prioritize response as exploitation likelihood evolves

How to Mitigate CVE-2026-87600

Immediate Actions Required

Update Google Chrome on Android to version 153.0.8010.36 or later through the Google Play Store
Push the updated Chrome build via mobile device management (MDM) to all managed Android devices
Communicate phishing and social engineering awareness guidance to end users, emphasizing caution with unexpected prompts inside the browser

Patch Information

Google released the fix in the Chrome Stable channel at version 153.0.8010.36. Refer to the Chrome Releases blog and Chromium Issue #517339356 for release metadata. Chrome on Android updates through the Google Play Store; enterprises using managed Google Play should confirm the updated version has propagated across their fleet.

Workarounds

Restrict browsing on high-risk Android devices to trusted sites until the Chrome update is confirmed installed
Deploy enterprise URL filtering on mobile gateways to block known malicious HTML content associated with Safe Browsing bypass campaigns
Disable installation of untrusted browser extensions or alternate Chromium-based browsers that share the vulnerable code path

bash

# Verify installed Chrome version on an Android device via ADB
adb shell dumpsys package com.android.chrome | grep versionName

# Expected output should show 153.0.8010.36 or later