CVE-2026-87552 in Chrome
Summary
by MITRE • 09/09/2026
Missing authorization in TrustedWebActivities in Google Chrome on on Android prior to 153.0.8010.36 allowed a local attacker to obtain sensitive information via a co-installed app. (Chromium security severity: High)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as missing authorization within the Trusted Web Activities implementation in Google Chrome for Android prior to version 153.0.8010.36 represents a significant breach of access control mechanisms designed to isolate web content from native application contexts. Trusted Web Activities allow websites to be launched inside a custom tab, providing an experience that resembles a native app while leveraging the browser engine's security model. However, in this specific instance, the implementation failed to enforce strict authorization checks when handling interactions between co-installed applications and the Chrome environment. This architectural flaw permits a local attacker who has installed a malicious application on the same device to exploit the trust relationship established by the operating system regarding app installation permissions. By leveraging the shared user ID or implicit intent resolution mechanisms that are often present in Android environments, an adversary can craft specific requests that bypass intended security boundaries, effectively tricking Chrome into processing actions or exposing data without verifying whether the initiating context is authorized to do so.
From a technical perspective, this flaw aligns with CWE-269, which classifies Improper Privilege Management, specifically where software does not properly assign privileges to actors based on their intended role or trust level. The vulnerability exploits the fact that Android allows co-installed apps to communicate more freely than those installed independently, assuming a higher degree of mutual trust. When Chrome fails to validate the origin and intent of these cross-application calls within the Trusted Web Activity framework, it creates an avenue for information disclosure. An attacker can utilize this weakness to extract sensitive data such as session tokens, cookies, or user-specific content that was intended to remain confined within the secure browsing context. The severity is rated high because the attack vector requires only local access and app installation, which are relatively low-barrier prerequisites in many mobile threat models, yet the impact involves the compromise of confidential information stored or processed by a widely used browser application.
The operational impact of this vulnerability extends beyond simple data leakage to potential session hijacking and identity impersonation within web services accessed through Chrome. If an attacker can intercept or manipulate the communication channel between the malicious app and Chrome via Trusted Web Activities, they may gain unauthorized access to authenticated sessions. This undermines the integrity of the user's online presence and compromises privacy expectations associated with private browsing modes or secure tabs. Furthermore, because this affects Android devices prior to a specific patch version, it impacts a broad range of users who have not yet updated their browser software. The persistence of such vulnerabilities in core system components like browsers highlights the complexity of maintaining security boundaries in multi-process architectures where different trust domains intersect.
Mitigation strategies primarily involve immediate software updates to ensure that Chrome is running at or above version 153.0.8010.36, which contains the necessary patches for these authorization checks. Users should enable automatic update features on their Android devices to receive security fixes promptly as they are released by Google and Chromium maintainers. Additionally, users can reduce risk by exercising caution when installing applications from unknown sources or third-party app stores, thereby limiting the pool of potential malicious co-installed apps that could attempt exploitation. From a developer standpoint, adhering strictly to least privilege principles in Android intent filters and validating all incoming intents against expected origins is critical for preventing similar issues in other components. Security researchers should also monitor ATT&CK techniques related to local application enumeration and inter-process communication abuse, as these represent the broader tactical behaviors associated with exploiting such misconfigurations.