CVE-2026-87595 in Chrome
Summary
by MITRE • 09/09/2026
Server-side request forgery in Mobile in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as Server-Side Request Forgery within the mobile implementation of Google Chrome prior to version 153.0.8010.36 represents a significant deviation from expected browser isolation boundaries, allowing for unauthorized access to internal system resources. This flaw specifically impacts the Android operating environment where Chrome operates with elevated privileges relative to standard web content. The core technical deficiency lies in how the browser handles requests initiated by untrusted HTML pages when those requests target local or restricted endpoints that are typically shielded from external network traffic. By crafting a specific HTML page containing malicious scripts, an attacker can trick the user into loading this page, thereby triggering the browser to make HTTP requests on behalf of the victim application. These forged requests exploit the trust relationship between the web content and the underlying operating system services, effectively bypassing standard access control mechanisms that are designed to prevent external entities from interacting with sensitive internal APIs or local server instances.
From a technical perspective, this vulnerability is classified under CWE-918, which denotes Server-Side Request Forgery (SSRF). SSRF vulnerabilities occur when an application fetches a remote resource without validating the user-supplied URL, allowing attackers to coerce the application into sending requests to unexpected destinations. In the context of Chrome on mobile, the attack vector relies heavily on social engineering because it requires the victim to actively visit or interact with a malicious webpage hosted by the attacker. Once the page is loaded, the browser's rendering engine processes the embedded code and executes network calls that appear legitimate from the perspective of the operating system but are unauthorized in intent. This bypasses security restrictions such as localhost filtering or internal IP blocklists that Chrome typically enforces to protect user privacy and device integrity. The severity is rated as Low by Chromium because while it allows for access restriction bypass, it does not directly lead to arbitrary code execution on the host machine without additional exploitation steps involving other vulnerabilities in system services.
The operational impact of this vulnerability centers on information disclosure and potential privilege escalation through indirect means. An attacker leveraging this flaw can probe internal network interfaces, discover running services on localhost or private networks, and potentially exfiltrate data from unprotected local endpoints. This could include sensitive configuration files, authentication tokens stored in local storage accessible via specific APIs, or status information about other applications installed on the device. The reliance on social engineering means that successful exploitation is not fully automated; it requires user interaction such as clicking a link or loading a webpage. However, given the prevalence of phishing campaigns and malicious advertisements, this barrier can often be overcome through deceptive design patterns or disguised links in emails and messaging platforms. The ability to bypass system access restrictions undermines the principle of least privilege applied by mobile operating systems, potentially exposing users to further attacks that build upon the initial foothold gained via SSRF.
Mitigation strategies for this vulnerability primarily involve updating the browser software to a version where the flaw has been patched. Users and administrators should ensure that Google Chrome is updated to version 153.0.8010.36 or later, as these releases contain code changes that enforce stricter validation of request origins and destinations within the mobile environment. Additionally, security awareness training remains critical in mitigating social engineering aspects of this attack; users must be educated on the risks of visiting untrusted websites and interacting with unknown content. From a defense-in-depth perspective, network-level controls such as firewall rules can help limit exposure to internal services that might otherwise be reachable via SSRF attacks. Furthermore, implementing Content Security Policy headers where applicable can restrict how scripts interact with external resources, although this is less effective against browser-native API calls triggered by the engine itself. Continuous monitoring for unusual outbound traffic patterns from mobile devices may also aid in detecting potential exploitation attempts in real-time environments.