CVE-2026-87482 in Chrome
Summary
by MITRE • 09/09/2026
Cleartext transmission of sensitive data in HttpsUpgrades in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker to leak sensitive information via crafted network traffic. (Chromium security severity: Medium)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as Cleartext transmission of sensitive data within the HttpsUpgrades component of Google Chrome on iOS prior to version 153.0.8010.36 represents a significant deviation from established secure communication protocols. This flaw specifically affects the browser's mechanism for upgrading insecure HTTP connections to encrypted HTTPS connections, a feature designed to protect user traffic from interception during transit. When this upgrade process fails or is bypassed due to the underlying technical defect, sensitive data such as authentication tokens, session cookies, personal identifiers, and financial information may be transmitted in plaintext over unencrypted network channels. This exposes users to potential eavesdropping by malicious actors positioned within the same network segment, including public Wi-Fi hotspots or compromised routers, who can capture and analyze this unencrypted traffic using standard packet sniffing tools.
From a technical perspective, the root cause lies in how the browser handles protocol upgrades when interacting with web servers that support both HTTP and HTTPS. Ideally, the client should enforce encryption by refusing to send sensitive payloads over an insecure channel or by ensuring the upgrade completes successfully before any data exchange occurs. In this instance, the implementation allowed for a race condition or logic error where sensitive information was dispatched prior to the establishment of the secure tunnel or when the upgrade request failed silently. This behavior contradicts modern security best practices which mandate that all user-generated content and authentication credentials be protected via Transport Layer Security (TLS). The severity is classified as Medium by Chromium standards, reflecting the potential for data leakage without necessarily allowing direct code execution or full system compromise on the device itself.
The operational impact of this vulnerability extends beyond simple privacy concerns to include risks of account takeover and session hijacking. Attackers who successfully intercept these cleartext transmissions can extract valid session cookies or authentication headers, which they may then replay in subsequent requests to impersonate the legitimate user. This is particularly dangerous for web applications that rely heavily on cookie-based state management without implementing additional safeguards like SameSite attributes or strict binding of sessions to specific IP addresses or User-Agent strings. Furthermore, the exposure of personal data contributes to broader privacy violations and can facilitate targeted phishing campaigns if attackers gain insight into a user's browsing habits or account structures based on the intercepted traffic patterns.
This flaw aligns closely with CWE-319, which categorizes cleartext transmission of sensitive information as a critical weakness in software design. It also maps to specific tactics within the MITRE ATT&CK framework, particularly T1048 (Exfiltration Over Alternative Protocol) and T1557 (Adversary-in-the-Middle), where attackers intercept communications between two parties who believe they are directly communicating with each other. The failure to enforce encryption during critical data exchanges undermines the confidentiality pillar of the CIA triad, leaving organizations and individuals vulnerable to passive reconnaissance attacks that require no active exploitation beyond network access.
Mitigation for this vulnerability requires immediate action by end-users to update Google Chrome on iOS devices to version 153.0.8010.36 or later, where the logic governing HTTPS upgrades has been corrected to prevent data leakage during protocol transitions. For developers and security engineers reviewing similar implementations, it is essential to ensure that all sensitive payloads are queued until a secure channel is fully established. Implementing strict Content Security Policy headers with strong upgrade-insecure-requests directives can also help enforce encryption at the application level. Additionally, organizations should monitor network traffic for anomalies indicative of protocol downgrade attacks and ensure that their security infrastructure includes intrusion detection systems capable of identifying cleartext transmission patterns in encrypted environments to detect potential exploitation attempts even after patching is applied.