CVE-2026-87534: Critical Android Chrome WebView Authorization Bypass — Detection, Patching, and Mobile Defense Guide

NVD has published CVE-2026-87534, a CVSS 9.8 (CRITICAL) vulnerability affecting Google Chrome on Android prior to version 153.0.8010.36. The flaw is a missing authorization check in WebView that allows a remote attacker — leveraging social engineering — to bypass Android system access restrictions via crafted network traffic. The vulnerability is exploitable over the network, which is what drives the NVD base score into critical territory.

One detail deserves immediate practitioner attention: Chromium's own security severity rating for this issue is Medium, while NVD scored it 9.8 Critical. That discrepancy is not a reason to deprioritize — it reflects a difference in scoring philosophy. Chromium's internal severity typically weights the requirement for user interaction and the constrained WebView context heavily, while NVD's CVSS assessment reflects the worst-case impact: a network-delivered bypass of OS-level access controls on the most widely deployed mobile platform on the planet. If your organization has a BYOD fleet or corporate-owned Android devices handling email, MFA apps, or SaaS sessions, treat this as a patch-this-week item.

WebView is not just Chrome — it is the embedded browser engine that countless Android apps use to render web content in-app. A missing authorization flaw in that component expands the attack surface well beyond users casually browsing in Chrome: any application embedding a vulnerable WebView that renders attacker-influenced content is a potential delivery vehicle.

Technical Analysis

Affected Products and Versions

How the Vulnerability Works (Defender's View)

WebView enforces authorization boundaries that determine what a loaded web page is allowed to do — which URL schemes it can invoke, whether it can reach Android system components, and whether it can cross out of the web sandbox into OS-level functionality. CVE-2026-87534 is a missing authorization check in that enforcement layer.

The attack chain from a defender's perspective:

1. Delivery (network + social engineering): The attacker lures the victim into rendering attacker-controlled content inside a WebView context — a link opened in an app's in-app browser, a malicious ad, a phishing message, or a crafted page. Exploitation is delivered via crafted network traffic, meaning the payload rides normal web requests.
2. Authorization bypass: Because the authorization check is missing, the crafted content can invoke behaviors WebView should have blocked — crossing from web content into protected Android system functionality.
3. Impact: The attacker bypasses system access restrictions. Depending on the hosting app and device configuration, this can mean access to protected components, scheme handlers, or data that should never be reachable from remote web content.

The requirement for social engineering (user interaction in CVSS terms) is the primary mitigating factor — and almost certainly the reason Chromium rated it Medium while NVD's 9.8 reflects the network vector and the severity of the boundary being crossed.

Exploitation Status

As of this writing, there are no confirmed reports of in-the-wild exploitation, no public proof-of-concept code has been widely circulated, and CVE-2026-87534 has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. That said, missing-authorization flaws in WebView are historically attractive to mobile exploit brokers and phishing operators because delivery requires only a rendered page. Defenders should operate on the assumption that weaponization attempts will follow public disclosure. Monitor the NVD record and CISA KEV for status changes.

Detection & Response

Mobile detection is genuinely hard — Android endpoints typically don't feed your SIEM the way Windows and Linux do. The most practical detection surface for this threat is upstream: your secure web gateway, DNS, and proxy logs where crafted URI delivery is observable, plus your MDM/EMM inventory for patch posture. The detections below are deliberately conservative to avoid the noise floor.

Sigma Rules

---
title: Crafted Android Intent URI Scheme Delivered Over Web Proxy
description: Detects delivery of intent:// URIs via web traffic, a common mechanism for abusing Android WebView scheme handling and bypassing access restrictions such as CVE-2026-87534. Legitimate intent:// usage from search ad networks exists, so scope to untrusted categories where possible.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87534
author: Security Arsenal
status: experimental
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1189
logsource:
  category: proxy
detection:
  selection_uri:
    cs-uri|contains:
      - 'intent://'
      - '#Intent;'
  condition: selection_uri
falsepositives:
  - Legitimate Android deep-linking from ad networks and mobile marketing campaigns
  - Corporate apps using intent URLs in internal portals
level: medium
---
title: Local Scheme Access Attempt via Web Request (file/content URI)
description: Detects web-delivered references to file:// and content:// URI schemes, which web content should never legitimately load on Android. Abusing local scheme handlers is a hallmark of WebView authorization bypass attacks including CVE-2026-87534.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87534
author: Security Arsenal
status: experimental
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1189
logsource:
  category: proxy
detection:
  selection:
    cs-uri|contains:
      - 'file:///'
      - 'content://'
    c-useragent|contains:
      - 'Android'
  condition: selection
falsepositives:
  - Rare; broken internal applications referencing local resources
level: high

KQL (Microsoft Sentinel / Defender)

// Hunt 1: Android devices observed loading crafted URI schemes via MDE network telemetry
// MDE on Android surfaces WebView/network events; tune to your onboarded fleet
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemoteUrl has_any ("intent://", "#Intent;", "content://", "file:///")
| project TimeGenerated, DeviceName, DeviceId, InitiatingProcessFileName, RemoteUrl, RemoteIP, ActionType
| order by TimeGenerated desc
;
// Hunt 2: Fleet exposure — Android devices with Chrome/WebView below the fixed build
// Requires mobile software inventory (MDE vulnerability management or MDM-exported table)
DeviceTvmSoftwareInventory
| where SoftwareName has_any ("chrome", "webview")
| where SoftwareVersion startswith "153." == false or SoftwareVersion matches regex @"^(1[0-4][0-9]|[0-9]{1,2})\."
| summarize Devices = dcount(DeviceId), DeviceNames = make_set(DeviceName, 25) by SoftwareName, SoftwareVersion
| order by Devices desc

Velociraptor VQL

Velociraptor does not deploy to Android directly, but the same Chrome 153 stable-channel fix train applies to managed desktop endpoints, and fleet-wide version verification is a legitimate hunt. Use this artifact to inventory Chrome installs across Windows endpoints and flag anything behind the 153 branch:

-- Inventory Chrome installations and flag versions below the 153 fix train
-- Correlates with CVE-2026-87534 remediation verification across managed fleet
SELECT FullPath,
       basename(path=dirname(path=FullPath)) AS ChromeVersion,
       Mtime AS BinaryModified
FROM glob(globs=[
  "C:/Program Files/Google/Chrome/Application/*/chrome.exe",
  "C:/Program Files (x86)/Google/Chrome/Application/*/chrome.exe"
])
WHERE NOT basename(path=dirname(path=FullPath)) =~ "^153\\."

Remediation Verification Script

For Android fleet verification, ADB against enrolled or lab devices is the fastest way to confirm the Chrome build. This Bash script checks every connected device and flags anything below 153.0.8010.36:

#!/bin/bash
# CVE-2026-87534 - Verify Chrome on Android is patched to 153.0.8010.36+
# Requires: adb with devices authorized

FIXED_MAJOR=153
FIXED_BUILD="153.0.8010.36"

echo "=== CVE-2026-87534 Chrome/Android patch verification ==="

for SERIAL in $(adb devices | awk 'NR>1 && $2=="device" {print $1}'); do
  VER=$(adb -s "$SERIAL" shell dumpsys package com.android.chrome 2>/dev/null \
        | grep -m1 versionName | cut -d= -f2 | tr -d '[:space:]')
  if [ -z "$VER" ]; then
    echo "[!] $SERIAL : Chrome not found or unreadable - investigate manually"
    continue
  fi
  MAJOR=${VER%%.*}
  if [ "$MAJOR" -lt "$FIXED_MAJOR" ] 2>/dev/null; then
    echo "[VULNERABLE] $SERIAL : Chrome $VER (below $FIXED_BUILD)"
  else
    echo "[OK]         $SERIAL : Chrome $VER"
  fi
done

echo "=== Sweep complete. Force update via Play Store or MDM app config for flagged devices. ==="

Remediation

1. Update Chrome on Android to 153.0.8010.36 or later immediately. Chrome on Android updates through the Play Store — most users will receive it automatically, but automatic updates stall on devices with restricted data, disabled Play services, or unmanaged profiles. Do not assume; verify.
2. Enforce minimum version via MDM/EMM. In your UEM console (Intune, Workspace ONE, ManageEngine, etc.), set a compliance policy requiring Chrome ≥ 153.0.8010.36 and mark non-compliant devices as conditional-access blocked until remediated. For Android Enterprise fully managed devices, push the app update as a required managed Google Play deployment.
3. Update the Android System WebView component on devices where WebView ships separately from Chrome (some Android builds and OEM skins). Confirm both com.android.chrome and the WebView provider package are current.
4. Reduce WebView exposure where patching lags: restrict in-app browsing in high-risk apps, disable "open links in app" for messaging/social apps on corporate profiles, and push users to open links in the fully patched Chrome browser rather than embedded WebViews.
5. Harden at the network layer. Deploy the proxy detections above, and consider blocking intent:// URI delivery at your secure web gateway for unmanaged device segments until patch verification completes.
6. User awareness — this bug requires social engineering. Refresh guidance on unsolicited links, QR codes, and in-app browser prompts. The exploitation requirement here is a user action; a trained user is a compensating control.
7. Monitor for escalation. Watch the NVD record (https://nvd.nist.gov/vuln/detail/CVE-2026-87534), the Chrome Stable channel release notes, and the CISA KEV catalog. If exploitation is confirmed, elevate to emergency change and treat unpatched devices as incident candidates.

There is no vendor workaround published beyond updating — the fix is the patch. Given the network attack vector and the breadth of the Android installed base, patch verification (not just patch deployment) is the deliverable your CISO should be asking for this week.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub