CVE-2026-87640: Google Chrome WebView Memory Disclosure

CVE-2026-87640 Overview

CVE-2026-87640 is an out-of-bounds read vulnerability in the WebView component of Google Chrome on Android. The flaw affects Chrome versions prior to 153.0.8010.36. A remote attacker who had already compromised the renderer process could read memory outside the sandbox by serving a crafted HTML page. Chromium rates the security severity as Medium. The weakness is classified under [CWE-125: Out-of-Bounds Read]. Successful exploitation requires user interaction and a prior renderer compromise, which raises the bar for attackers but preserves meaningful confidentiality impact when chained.

Critical Impact
An attacker who has compromised the Chrome renderer on Android can read memory outside the sandbox boundary through crafted HTML delivered to WebView, potentially exposing sensitive process data.

Affected Products

Google Chrome for Android prior to 153.0.8010.36
Google Android devices running vulnerable Chrome WebView builds
Applications embedding Android System WebView based on affected Chrome versions

Discovery Timeline

2026-09-09 - CVE-2026-87640 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87640

Vulnerability Analysis

The vulnerability resides in Chrome's WebView on Android, the component that renders web content inside native applications. WebView reads memory beyond an allocated buffer when processing attacker-controlled data. Because the read occurs after renderer compromise, the attacker can transform an in-process foothold into cross-boundary information disclosure. Chromium's multi-process sandbox is designed to constrain a compromised renderer, so an out-of-bounds read that leaks memory outside that sandbox undermines a core security guarantee. Exploitation requires user interaction, typically loading a crafted page, and high attack complexity, which reflects the need for a prior exploit stage.

Root Cause

The defect is an out-of-bounds read [CWE-125] in WebView. The affected code path fails to enforce correct bounds when accessing a buffer during page or resource handling. The result is that memory adjacent to legitimate structures becomes readable by attacker-controlled logic executing in the renderer process. Google fixed the issue in Chrome 153.0.8010.36 on the stable channel.

Attack Vector

Exploitation is network-based and follows a two-stage model. The attacker first compromises the renderer process, then delivers a crafted HTML page that triggers the out-of-bounds read in WebView. The scope is changed because the disclosure crosses the sandbox boundary. Impact is limited to confidentiality: memory contents may leak, but integrity and availability are not directly affected. Refer to the Chromium Issue Tracker #498482618 and the Chrome Releases stable channel update for vendor-specific technical details.

Detection Methods for CVE-2026-87640

Indicators of Compromise

Android devices or managed applications running Chrome or Android System WebView at a version below 153.0.8010.36.
Renderer process crashes or anomalous memory access patterns coinciding with visits to untrusted web content.
Outbound requests to attacker infrastructure from WebView-embedded applications after loading crafted HTML.

Detection Strategies

Inventory installed Chrome and Android System WebView versions across managed mobile fleets and flag builds below 153.0.8010.36.
Correlate mobile threat telemetry with browsing events to identify sessions where renderer instability follows navigation to unknown domains.
Hunt for suspicious WebView-hosting applications that load remote HTML from uncontrolled origins.

Monitoring Recommendations

Enable mobile application and browser telemetry forwarding to your SIEM or data lake for centralized version and event correlation.
Track Chromium security release notes and align patch windows with vendor stable channel updates.
Monitor Android crash reports for repeated renderer or WebView faults that may indicate exploitation attempts.

How to Mitigate CVE-2026-87640

Immediate Actions Required

Update Google Chrome for Android to 153.0.8010.36 or later through Google Play.
Update Android System WebView to the corresponding fixed version and restart affected applications.
Audit in-house and third-party Android applications that embed WebView and confirm they inherit the patched runtime.

Patch Information

Google addressed CVE-2026-87640 in Chrome 153.0.8010.36 on the stable channel. Details are available in the Chrome Releases announcement and the Chromium Issue Tracker entry #498482618. Deploy the update through mobile device management or Google Play managed distribution to ensure timely coverage.

Workarounds

Restrict WebView-embedded applications from loading arbitrary remote content until patches are applied.
Enforce mobile device management policies that block installation of untrusted applications relying on WebView.
Educate users to avoid opening links from untrusted sources on Android devices pending update rollout.

bash

# Configuration example: verify Chrome and WebView versions on a managed Android device
adb shell dumpsys package com.android.chrome | grep versionName
adb shell dumpsys package com.google.android.webview | grep versionName