CVE-2026-87640 describes an out of bounds read in the WebView component of Google Chrome on Android devices before version 153.0.8010.36. The vulnerability enables a remote attacker, with prior compromise of the renderer process, to read memory outside the sandbox environment via a specially crafted HTML page. This could potentially expose sensitive information from memory. The Chromium security team has assigned this vulnerability a medium severity rating. The vendor advisory linked does not explicitly confirm a patch or remediation status.

The vulnerability allows an attacker who has already compromised the renderer process to read memory outside the sandbox, potentially exposing sensitive information. The impact is limited to information disclosure and requires prior compromise of the renderer process. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html for current remediation guidance. Users should update to version 153.0.8010.36 or later when available to address this issue.