CVE-2026-87640: 
Google Chrome vulnerability analysis and mitigation

CVE-2026-87640 is an out-of-bounds read vulnerability in WebView in Google Chrome on Android, allowing a remote attacker who has already compromised the renderer process to read memory outside the sandbox via a crafted HTML page. It affects all versions of Google Chrome for Android prior to 153.0.8010.36. The vulnerability was reported by researcher c6eed09fc8b174b0f3eebedcceb1e792 on April 1, 2026, and publicly disclosed on September 9, 2026, as part of the Chrome 153 stable channel release. It carries a CVSS v3.1 base score of 6.1 (Medium) (Github Advisory, Chrome Release).

The vulnerability is classified as CWE-125 (Out-of-bounds Read) and resides in the WebView component of Google Chrome on Android. When a compromised renderer process processes a specially crafted HTML page, it can trigger a read operation that accesses memory beyond the intended buffer boundaries, potentially leaking data from outside the sandbox. Exploitation requires the attacker to have already achieved renderer process compromise — meaning this vulnerability is a sandbox escape primitive rather than an initial access vector. The Chromium issue tracker reference is issues.chromium.org/issues/498482618, though details remain restricted pending broad user update (Github Advisory, Chrome Release).

Successful exploitation results in a high confidentiality impact — an attacker with a compromised renderer can read arbitrary memory outside the Chrome sandbox on Android devices, potentially exposing sensitive data such as credentials, session tokens, or other in-memory content from the broader process space. There is no integrity or availability impact. The scope change (S:C in CVSS) indicates that the impact extends beyond the vulnerable component (the renderer sandbox) to affect the broader system (Github Advisory).

There is no public proof-of-concept exploit available for CVE-2026-87640, and no evidence of in-the-wild exploitation has been observed. The NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable, reflecting the high attack complexity and the prerequisite of prior renderer compromise. The EPSS score is approximately 0.225%, placing it in the 11th percentile for exploitation likelihood. CVE-2026-87640 is not listed in the CISA Known Exploited Vulnerabilities catalog (Github Advisory, Chrome Release).

Google has addressed this vulnerability in Chrome 153.0.8010.36 for Android (and 153.0.8010.36/.37 for Windows/Mac/Linux). Users should update Google Chrome on Android to version 153.0.8010.36 or later immediately. Enabling automatic updates in the Google Play Store is the recommended approach to ensure timely receipt of security patches. No configuration-based workaround is available; patching is the only remediation (Chrome Release).

The Chrome 153 release, which includes 230 security fixes, received coverage from security news outlets including CyberSecurityNews and CyberPress, primarily focused on the breadth of the release and the separately noted in-the-wild exploit for CVE-2026-87491 (an out-of-bounds write in V8). CVE-2026-87640 itself did not attract significant standalone commentary given its medium severity and the prerequisite of prior renderer compromise (Chrome Release).