CVE-2026-87534 in Chrome
Summary
by MITRE • 09/09/2026
Missing authorization in WebView in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via crafted network traffic. (Chromium security severity: Medium)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as missing authorization within the WebView component of Google Chrome for Android represents a significant breach in application-level access control mechanisms. This flaw, present in versions prior to 153.0.8010.36, stems from an insufficient validation of user privileges when handling network requests initiated by web content rendered within the embedded browser context. In standard security architecture, WebView components are expected to enforce strict boundaries between web-based scripts and native Android system APIs or sensitive data stores. However, in this specific instance, the implementation failed to properly verify whether the originator of a particular request possessed the necessary authorization credentials before allowing it to interact with restricted system resources. This architectural oversight creates a pathway for privilege escalation where code executing within the less-privileged web context can effectively gain access to functionalities or data reserved for higher-privilege contexts without proper authentication checks.
From an operational perspective, this vulnerability allows remote attackers to bypass critical security restrictions through sophisticated social engineering tactics rather than direct technical exploitation of network protocols alone. The attacker typically crafts malicious network traffic that appears legitimate but contains specific parameters designed to trigger the authorization flaw within the WebView engine. When a user is tricked into visiting a compromised website or interacting with a specially crafted link, the embedded web content can execute scripts that exploit this missing check. These scripts then issue requests that bypass standard Android permission models, potentially allowing access to private application data, sensitive cookies, session tokens, or other protected resources associated with the host application or system level services. The severity is classified as medium by Chromium security standards because while it requires user interaction via social engineering, the impact can be severe depending on the specific context and permissions granted to the Chrome process at that time.
This incident aligns closely with Common Weakness Enumeration (CWE) category CWE-269, which defines Improper Privilege Assignment, specifically highlighting scenarios where a subject is allowed to perform actions beyond its intended security level due to flawed authorization logic. Furthermore, in terms of the MITRE ATT&CK framework for mobile platforms, this vulnerability facilitates techniques associated with Initial Access and Credential Access. The attacker leverages social engineering as an initial vector, which corresponds to tactics like Spearphishing Link or Malicious Website. Once inside the WebView environment, the exploitation of missing authorization maps directly to Defense Evasion by bypassing system access restrictions and potentially Data Exfiltration if sensitive information is retrieved through these unauthorized channels. The reliance on crafted network traffic indicates that the attack payload is delivered via standard HTTP/HTTPS protocols, making it difficult for traditional signature-based intrusion detection systems to identify without deep packet inspection or behavioral analysis capabilities focused on WebView-specific anomalies.
Mitigation strategies primarily involve updating the Google Chrome application on Android devices to version 153.0.8010.36 or later, where these authorization checks have been rigorously enforced and validated by Chromium developers. For organizations deploying managed browsers or custom WebView implementations based on older codebases, it is imperative to apply vendor-provided patches immediately. Additionally, security administrators should enforce strict Content Security Policy (CSP) configurations that restrict inline scripts and limit the sources from which content can be loaded, thereby reducing the attack surface available for social engineering campaigns. Implementing robust user awareness training programs is also critical to mitigate the human element of this threat vector, as the vulnerability relies heavily on deceiving users into interacting with malicious web content. Regular security audits focusing on authorization logic in hybrid applications and WebView integrations can further prevent similar flaws from being introduced or persisting in legacy code paths.