CVE-2026-87534 is a missing authorization flaw in WebView in Google Chrome on Android. The record scores it 9.8, while Chromium rates the issue Medium. A remote attacker using social engineering could bypass system access restrictions. Chrome 153.0.8010.36 and later contain the fix, so update.
What's affected
The record lists Google Chrome on Android before 153.0.8010.36, and the Android platform. Chrome's stable channel post for the 153 release lists the fixed build as 153.0.8010.36, and says that release carries 230 security fixes.
Note the two ratings. The 9.8 in the record comes from the CVSS vector. The Chromium security severity in the same record text is Medium. The difference comes from how Chromium weighs the need for social engineering and other conditions.
How to check if you're exposed
On an Android device, open Chrome, then the menu, then Settings, then About Chrome, and read the version. It must be 153.0.8010.36 or later. You can also open the Play Store page for Chrome and look for a pending update.
For managed fleets, use your mobile device management console to report the Chrome version per device, and list devices below the fixed build.
What to do now
- Update Chrome on Android to 153.0.8010.36 or later.
- Report Chrome versions across managed devices and chase those that lag.
- Check apps that embed web content on your devices and keep them updated as well.
- Turn on automatic updates for Chrome in the Play Store.
Why it matters
The weakness is CWE-862 (missing authorization). A check that should decide whether an action is allowed was not performed in the WebView component, so a request could do something that system restrictions were meant to stop. Chromium rated the issue Medium, and the details in the bug tracker are restricted until most users have updated.
The record does not mark this CVE as known exploited, and it is not in the CISA KEV list. Browser updates are the main control, since users cannot configure their way around a flaw in the browser engine.
Quick check
Why is the score 9.8 if Chromium says Medium?
The CVSS number is computed from the vector in the record. Chromium applies its own severity scale. Use the fixed version as your target, whichever number you look at.
If you want a quick look at your own dependencies, the free in-browser scan at gold.safeguard.sh/scan needs no repository access.
Sources
Fetched for this guide:
Last reviewed: 19 October 2026.
