CVE-2026-87486

Analyzed Analyzed - Analysis Complete

Clickjacking in Google Chrome on Android

Publication date: 2026-09-09

Last updated on: 2026-09-10

Assigner: Chrome

Description

Clickjacking in TrustedWebActivities in Google Chrome on on Android prior to 153.0.8010.36 allowed a local attacker to spoof address bar via a co-installed app. (Chromium security severity: Medium)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-10

Generated

2026-09-29

AI Q&A

2026-09-09

EPSS Evaluated

2026-09-27

NVD

CVE-2026-87486

EUVD

EUVD-2026-74368

Affected Vendors & Products

Vendor	Product	Version / Range
google	chrome	to 153.0.8010.36 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1021	The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with.

Attack-Flow Graph

Executive Summary

This vulnerability is a clickjacking issue in TrustedWebActivities within Google Chrome on Android. It allows a local attacker with a co-installed app to spoof the address bar, potentially tricking users into visiting malicious sites while appearing to be on a legitimate one.

Detection Guidance

This vulnerability is specific to Google Chrome on Android and involves clickjacking through TrustedWebActivities. Detection typically requires checking Chrome version and app interactions. No direct commands are provided in the context, but you can verify Chrome version via 'chrome --version' or in Android app settings. Ensure Chrome is updated to version 153.0.8010.36 or later.

Impact Analysis

This vulnerability could allow an attacker to deceive you into interacting with a malicious site while the address bar shows a trusted URL. This might lead to phishing attacks, unauthorized actions, or exposure of sensitive information.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or other major standards. It involves a local attacker spoofing the address bar via a co-installed app, which is a UI deception issue rather than a data exposure or privacy violation.

Mitigation Strategies

Update Google Chrome on Android to version 153.0.8010.36 or later to address the clickjacking vulnerability.

Hi! I’m here to help you understand CVE-2026-87486. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70