Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-87534: Google Chrome Android before 153 allows attacker to bypass restrictions
CVE-2026-87534 · published 1 month ago
Summary
Versions of Google Chrome for Android and the Chromium browser on Debian that are older than the latest release can be tricked by a malicious web page into bypassing normal system access controls. This could let an attacker gain unauthorized access to the device or data. Update Chrome and Chromium to the newest version as soon as possible to close the gap.
What to do
- Update google chrome to version 153.0.8010.36 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | chrome |
< 153.0.8010.36 cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* |
|
| Debian:12 | debian | chromium | All versions |
Original advisory text
Missing authorization in WebView in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via crafted netwo...
Missing authorization in WebView in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via crafted network traffic. (Chromium security severity: Medium)
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
9.8
Critical
Type
CWE-862Missing Authorization
Timeline
Published9 Sep 2026
Updated12 Oct 2026
First seen9 Sep 2026
Track software like this
Free during beta