CVE-2026-87463

Analyzed Analyzed - Analysis Complete

Incorrect Authorization in Chrome Certificate on Android

Publication date: 2026-09-09

Last updated on: 2026-09-09

Assigner: Chrome

Description

Incorrect authorization in Certificate in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to potentially spoof address bar via crafted network traffic. (Chromium security severity: Low)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-09

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-87463

EUVD

EUVD-2026-74452

Affected Vendors & Products

Vendor	Product	Version / Range
google	chrome	to 153.0.8010.36 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability involves incorrect authorization in Google Chrome on Android. It allows a remote attacker to potentially spoof the address bar by manipulating network traffic. This could trick users into believing they are on a legitimate website when they are not.

Detection Guidance

This vulnerability involves incorrect authorization in Google Chrome on Android. Detection primarily relies on verifying Chrome version and monitoring for spoofed address bars. Check Chrome version via Settings > About Chrome or command: adb shell dumpsys package com.android.chrome | grep versionName. Ensure version is 153.0.8010.36 or higher.

Impact Analysis

This vulnerability could lead to phishing attacks where users are deceived into entering sensitive information on fake websites. It may also result in unauthorized actions being performed under the guise of a trusted site.

Compliance Impact

This vulnerability involves incorrect authorization in Google Chrome on Android, potentially allowing address bar spoofing via crafted network traffic. While it does not directly impact GDPR or HIPAA compliance, such vulnerabilities could lead to unauthorized data exposure or phishing risks, which may indirectly affect compliance with privacy standards.

Mitigation Strategies

Update Google Chrome on Android to version 153.0.8010.36 or later. Disable automatic updates temporarily if needed, but prioritize updating to patch the incorrect authorization issue. Avoid untrusted networks until updated.

Hi! I’m here to help you understand CVE-2026-87463. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70