CVE-2026-87545 in Chrome
Summary
by MITRE • 09/09/2026
Information leak in Mobile in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to leak sensitive information via a crafted HTML page. (Chromium security severity: Low)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as an information leak within the mobile version of Google Chrome on iOS prior to version 153.0.8010.36 represents a significant privacy concern stemming from improper handling of sensitive data during web page rendering and navigation events. This flaw allows a remote attacker, who typically relies on social engineering tactics such as phishing or malicious advertising networks, to extract confidential information from the user's browsing session. The attack vector involves the creation of a specially crafted HTML page that exploits specific behaviors in the browser engine when interacting with iOS-specific APIs or internal state management mechanisms. By leveraging these interactions, an attacker can trigger conditions where sensitive data, such as cookies, local storage contents, or previously entered form data, is inadvertently exposed to unauthorized scripts running within the malicious context.
From a technical perspective, this issue falls under the category of improper access control and information exposure vulnerabilities. It aligns closely with Common Weakness Enumeration (CWE) identifiers such as CWE-200, which covers Exposure of Sensitive Information to an Unauthorized Actor, and potentially CWE-798 if it involves hardcoded credentials or sensitive data in configuration files that are inadvertently made accessible through the browser's execution environment. The root cause likely resides in how Chrome on iOS manages cross-origin requests or handles state persistence across different web contexts without adequate sanitization or isolation checks. When a user visits the crafted page, the malicious script can exploit these gaps to read data that should remain confined to specific domains or secure storage areas, effectively bypassing standard browser security boundaries designed to prevent such leaks.
The operational impact of this vulnerability is primarily centered around privacy violations and potential credential theft. Since the attack requires social engineering, it targets users who are tricked into visiting malicious sites through deceptive links in emails, messages, or compromised websites. Once executed, the attacker can harvest sensitive information that may include session tokens, personal identification details, or authentication credentials stored by web applications. This data can then be used for account takeover attacks, identity theft, or further targeted phishing campaigns against the victim and their contacts. The severity is classified as low within Chromium's internal security framework because it requires user interaction to initiate the exploit, but its real-world impact remains high due to the sensitivity of the leaked information and the prevalence of social engineering tactics in modern cyber threats.
Mitigation strategies for this vulnerability involve both immediate patching and long-term defensive practices. The primary remediation is to update Google Chrome on iOS to version 153.0.8010.36 or later, where these specific handling flaws have been addressed by the development team through improved input validation and stricter isolation of sensitive data contexts. Users should ensure that automatic updates are enabled for their mobile browsers to receive security patches promptly. Additionally, organizations and individual users can employ browser extensions or built-in privacy features such as strict cookie policies, third-party tracking prevention, and sandboxing modes to limit the amount of accessible information available to malicious scripts. Awareness training regarding social engineering tactics is also critical, as it reduces the likelihood of users falling for the initial lure required to trigger this vulnerability.
In terms of threat intelligence mapping, this activity corresponds to techniques found in the MITRE ATT&CK framework, specifically those related to Collection and Exfiltration over C2 channels if the stolen data is transmitted back to an attacker-controlled server. It also relates to Initial Access via Spearphishing Link when combined with deceptive delivery methods. Security teams should monitor for indicators of compromise associated with known malicious domains hosting similar crafted HTML pages and update web application firewalls or content security policies to restrict unauthorized access to sensitive endpoints that might be targeted by such exploits. Continuous monitoring and regular software updates remain the most effective defenses against evolving browser-based vulnerabilities like this one.