CVE-2026-87534

A missing authorization flaw in Chrome's WebView on Android allowed remote attackers to bypass system access restrictions via crafted network traffic.

This vulnerability in Google Chrome's WebView component on Android enabled remote attackers to bypass system access restrictions using social engineering and crafted network traffic. DIB organizations must ensure their Android devices running Chrome are patched to version 153.0.8010.36 or later to prevent potential unauthorized access and data exposure. The flaw is not an RCE or zero-day, but its exploitation via social engineering highlights the need for strict mobile device management and timely patching.

Shame score — A critical CVSS 9.8 vulnerability in a widely deployed browser component that required patching to mitigate, indicating a failure in timely patch management despite the vendor's eventual release of a fix.