CVE-2026-87624: Google Chrome XSS Vulnerability

CVE-2026-87624 Overview

CVE-2026-87624 is a user interface (UI) misrepresentation vulnerability in the Passwords component of Google Chrome on Android. Versions prior to 153.0.8010.36 are affected. A remote attacker who has already compromised the renderer process can spoof UI elements by serving a crafted HTML page. The flaw is classified under [CWE-451: User Interface (UI) Misrepresentation of Critical Information]. Google's Chromium team rated the internal security severity as Low. Successful exploitation could mislead users into entering credentials or trusting attacker-controlled content presented as legitimate browser UI.

Critical Impact
An attacker with a compromised renderer process can spoof password-related browser UI on Android, enabling credential theft or user deception through crafted HTML pages.

Affected Products

Google Chrome on Android prior to 153.0.8010.36
Google Android (as the host platform for the affected Chrome build)
Chromium-based browsers on Android that share the vulnerable Passwords component

Discovery Timeline

2026-09-09 - CVE-2026-87624 published to the National Vulnerability Database (NVD)
2026-09-10 - Last updated in the NVD database

Technical Details for CVE-2026-87624

Vulnerability Analysis

The vulnerability resides in the Passwords feature of Chrome for Android. Chrome's renderer process handles untrusted web content in a sandbox separate from the browser process. When the renderer is already compromised, this issue allows the attacker to influence how password-related UI elements are rendered on screen. The result is a mismatch between what the user sees and the trust context Chrome intends to convey. Exploitation requires user interaction and depends on the attacker having first achieved renderer compromise through a separate flaw. The vulnerability does not enable arbitrary code execution on its own, but it enhances the impact of chained exploits by supporting convincing credential-phishing overlays inside a trusted app.

Root Cause

The root cause is improper isolation between renderer-controlled content and browser-owned password UI on the Android platform. Chrome does not sufficiently distinguish native browser chrome from renderer-drawn HTML in the affected code paths. This aligns with [CWE-451], where security-relevant information is displayed in a way that misleads the user.

Attack Vector

Exploitation requires network delivery of a crafted HTML page and prior compromise of the renderer process. The attacker then manipulates rendered content to spoof Passwords UI, such as autofill prompts or credential dialogs. The user must interact with the spoofed UI for the attack to succeed. No verified proof-of-concept, exploit code, or in-the-wild exploitation has been published for this CVE.

No public exploit code is available. See the Chromium Issue Tracker Entry for technical details once access is granted.

Detection Methods for CVE-2026-87624

Indicators of Compromise

Android devices running Chrome versions earlier than 153.0.8010.36 accessing untrusted or newly registered domains.
Renderer process crash reports or sandbox anomalies preceding password entry events in Chrome on Android.
User reports of unexpected autofill or password dialogs appearing on non-login pages.

Detection Strategies

Inventory Chrome versions across managed Android fleets and flag installations below 153.0.8010.36.
Correlate mobile browsing telemetry with known malicious or newly observed domains serving crafted HTML.
Review mobile threat defense alerts for phishing pages that mimic Chrome password UI.

Monitoring Recommendations

Monitor Google Play Managed configuration reports for Chrome update compliance on Android endpoints.
Track authentication anomalies such as credential reuse from mobile user agents shortly after visits to untrusted sites.
Ingest mobile endpoint and network telemetry into a centralized data lake to correlate browser version, URL access, and downstream identity events.

How to Mitigate CVE-2026-87624

Immediate Actions Required

Update Google Chrome on Android to version 153.0.8010.36 or later through the Google Play Store.
Enforce automatic app updates for Chrome across managed Android devices using Mobile Device Management (MDM) or Enterprise Mobility Management (EMM).
Educate users to verify the origin of password prompts and avoid entering credentials on unexpected dialogs.

Patch Information

Google addressed CVE-2026-87624 in Chrome 153.0.8010.36. Refer to the Google Chrome Stable Channel Update Announcement for release details and the Chromium Issue Tracker Entry for the associated bug record.

Workarounds

Disable Chrome password autofill on Android until the patched version is installed.
Restrict browsing to trusted domains via web filtering policies applied to mobile endpoints.
Use a separate password manager application that renders credential prompts outside the browser process.

bash

# Verify installed Chrome version on an Android device via ADB
adb shell dumpsys package com.android.chrome | grep versionName

# Expected output for patched build:
# versionName=153.0.8010.36