CVE-2026-87595: 
Google Chrome vulnerability analysis and mitigation

CVE-2026-87595 is a Server-Side Request Forgery (SSRF) vulnerability in the Mobile component of Google Chrome that allows a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. It affects all versions of Google Chrome prior to 153.0.8010.36. The vulnerability was reported to Google on May 16, 2026, and publicly disclosed on September 9, 2026, when Chrome 153 was promoted to the stable channel. Google assigned this a Chromium security severity of Low, though the NVD CVSS v3.1 base score is 9.8 (Critical) — a notable discrepancy likely reflecting the social engineering precondition (Chrome Release, Github Advisory, Red Hat).

The vulnerability is classified as CWE-918 (Server-Side Request Forgery), where Chrome's Mobile component fails to sufficiently validate or restrict URLs or requests initiated via a crafted HTML page, allowing an attacker to cause the browser to make requests to unintended destinations and bypass system access restrictions. Exploitation requires social engineering — the victim must be induced to visit a malicious HTML page, which then triggers the SSRF condition. The Chromium issue tracker entry is 513726466, though full technical details remain restricted pending broad user update. No public proof-of-concept or detailed technical write-up has been published (Chrome Release, Github Advisory).

Successful exploitation could allow a remote attacker to bypass system access restrictions on the affected mobile Chrome instance, potentially enabling unauthorized access to internal resources or services that would otherwise be inaccessible from the internet. The NVD scoring reflects high confidentiality, integrity, and availability impact, though the practical impact is constrained by the social engineering requirement. No evidence of data exfiltration or lateral movement resulting from exploitation has been reported at this time (Github Advisory, Red Hat).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The NVD SSVC assessment confirms exploitation status as "none" and the vulnerability is automatable in theory, but the social engineering precondition significantly limits practical exploitability. The EPSS score is approximately 0.178%, placing it in the lower percentiles for near-term exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Github Advisory, Red Hat).

Google has patched this vulnerability in Chrome 153.0.8010.36 (Linux) and 153.0.8010.36/.37 (Windows/Mac), released September 8, 2026. Users should update Google Chrome to version 153.0.8010.36 or later immediately via the browser's built-in update mechanism. As a behavioral mitigation, users should exercise caution when clicking links or visiting websites from untrusted sources, as exploitation requires social engineering. No configuration-based workaround has been published by Google (Chrome Release).

The Chrome 153 release was covered by security-focused outlets such as CyberPress, which noted the update addresses 230 security flaws. The Italian tech site Telefonino.net also highlighted the update as urgent. OpenSUSE issued a security announcement for its users regarding the Chrome 153 update. No notable independent researcher commentary or significant social media discussion specific to CVE-2026-87595 has been identified, consistent with its low Chromium severity rating despite the high NVD CVSS score (Chrome Release).