Improper input validation in Safebrowsing in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker leveraging social… (CVE-2026-87600)
Source GCVE Database
Not known to be exploited.
Data as of 10/25/2026, 04:40:14 UTC
CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 21% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
What to do
AI-suggested
Users and administrators should monitor official Google Chrome security advisories for updates and apply any available updates promptly once released.
Description
An improper input validation vulnerability exists in the Safebrowsing component of Google Chrome on Android versions prior to 153.0.8010.36. This flaw allows a remote attacker to bypass system access restrictions by leveraging social engineering and a crafted HTML page. The vulnerability is rated medium severity by Chromium security. No known exploits are reported in the wild, and no official patch information is provided.
Impact
The vulnerability could allow a remote attacker to bypass system access restrictions on affected versions of Google Chrome on Android by tricking users through social engineering and malicious HTML content. No known exploits are reported, so the practical impact is currently theoretical.
Weaknesses
- CWE-20Improper Input Validation (opens in a new tab)
Class weaknessLikelihood of exploit: HighCWE Top 25 (2025): #18OWASP Top 10 A05:2025: Injection (opens in a new tab)
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
MITRE discourages mapping vulnerabilities to this broad entry; the root cause is usually a more specific weakness.