CVE-2026-87522 Google CVE debrief

Who should care

Defenders responsible for Chrome on Android deployments, particularly those using WebView, should assess exposure and prioritize remediation. This includes reviewing WebView authorization checks and Chrome updates on Android. Defenders should also verify system updates and review system access restrictions and network traffic controls.

Why it matters

CVE-2026-87522 is a medium-severity vulnerability in Google Chrome on Android, allowing remote attackers to potentially bypass system access restrictions via crafted network traffic due to missing authorization in WebView. Defenders should assess exposure, prioritize remediation, and verify system updates.

• Potential bypass of system access restrictions
• Increased risk of unauthorized access
• Need for WebView authorization checks
• Priority for Chrome updates on Android

Technical summary

CVE-2026-87522 is a medium-severity vulnerability in Google Chrome on Android, allowing remote attackers to potentially bypass system access restrictions via crafted network traffic due to missing authorization in WebView. The vulnerability has a CVSS score of 6.5 and defenders should review WebView authorization checks and Chrome updates on Android. This vulnerability affects Chrome on Android prior to version 153.0.8010.36. Defenders should assess exposure and prioritize remediation. The CVE record and NVD detail page provide additional context.

Defensive priority

Medium priority for Chrome on Android updates and WebView authorization checks

Recommended defensive actions

• Assess exposure of Chrome on Android deployments to this vulnerability
• Prioritize updates to Chrome version 153.0.8010.36 or later
• Verify WebView authorization checks in affected systems
• Review system access restrictions and network traffic controls
• Implement compensating controls for exposed systems
• Review monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets

Evidence notes

Official CVE Program record and NIST NVD detail page provide vulnerability metadata and assessment. Google Chrome release notes and issue tracker offer additional context. Defenders should verify system updates and review WebView authorization checks. The vulnerability has a CVSS score of 6.5 and a medium severity. There is no evidence of exploit or ransomware campaign use.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.