CVE-2026-87503 in Chrome
Summary
by MITRE • 09/09/2026
Inappropriate implementation in Downloads in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as an inappropriate implementation within the Downloads component of Google Chrome for Android prior to version 153.0.8010.36 represents a significant deviation from expected security boundaries regarding file system access and user consent mechanisms. This flaw allows a remote attacker, who typically relies on social engineering tactics such as phishing or malicious web page hosting, to circumvent the operating system's standard permission models. The core technical issue lies in how the browser handles requests for downloading files that may trigger automatic installation or execution of applications, specifically Android Package Kits (APKs). Instead of strictly enforcing user interaction and explicit confirmation at every critical step where security boundaries are crossed, the implementation permits a crafted HTML page to manipulate the download manager into bypassing these restrictions. This effectively reduces the attack surface by removing the friction that normally prevents unauthorized application installation or data exfiltration without clear user intent.
From an operational perspective, this vulnerability enables a remote attacker to install malicious applications on a victim's device with elevated privileges relative to what would be allowed under normal circumstances. By leveraging social engineering, the attacker can craft a webpage that appears benign but contains code designed to exploit this specific logic error in the download handler. Once triggered, the browser may proceed to download and potentially auto-install an APK or trigger other actions that bypass the Android system's permission prompts. This results in unauthorized access to device resources, potential data theft, and the establishment of a persistent foothold for further exploitation. The severity is classified as medium because while it requires user interaction via social engineering, the ease with which this interaction can be manipulated makes it a viable vector for widespread compromise, particularly on mobile devices where users may have less granular control over application permissions compared to desktop environments.
This vulnerability aligns closely with CWE-20 Improper Input Validation and CWE-798 Use of Hard-coded Credentials if the bypass involves default configurations that are insecure by design. More specifically, it relates to CWE-250 Execution with Unnecessary Privileges, as the downloaded content may execute with higher privileges than intended due to the bypassed restrictions. In terms of offensive security frameworks, this behavior is consistent with ATT&CK technique T1059 Command and Scripting Interpreter if the vulnerability leads to script execution, or more accurately T1204 User Execution when considering the social engineering aspect required to trigger the flaw. The attack vector falls under Remote Code Execution (RCE) via a Web Application interface, specifically exploiting trust relationships between the browser engine and the underlying operating system's package installer service.
Mitigation strategies primarily involve updating Google Chrome on Android devices to version 153.0.8010.36 or later, where these implementation flaws have been addressed by enforcing stricter validation of download origins and ensuring that all privilege escalations require explicit user consent through standard UI prompts. Security administrators should also enforce mobile device management policies that restrict the installation of applications from unknown sources unless explicitly authorized for specific enterprise use cases. Additionally, users must be educated on recognizing social engineering attempts, as this vulnerability relies heavily on tricking the end-user into visiting a malicious site or interacting with deceptive content. Regular security awareness training and keeping all software components up to date remain the most effective defenses against such logic-based vulnerabilities that exploit trust boundaries in web browsers.