Information leak in Mobile in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to leak… (CVE-2026-87545)
Source GCVE Database
Not known to be exploited · fixed in 153.0.8010.36 : update affected systems when convenient.
Data as of 10/25/2026, 04:40:14 UTC
CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 23% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 153.0.8010.36
What to do
AI-suggested
A fix is available in Google Chrome on iOS version 153.0.8010.36. Users and administrators should update to this version or later to remediate the vulnerability. No additional mitigation steps are indicated.
Description
An information leak vulnerability exists in Google Chrome on iOS versions prior to 153.0.8010.36. This flaw allows a remote attacker to leverage social engineering techniques to cause sensitive information to be leaked via a crafted HTML page. The issue is classified with low severity by Chromium security. No CVSS score or exploit in the wild is currently known.
Impact
The vulnerability can lead to unauthorized disclosure of sensitive information to a remote attacker through social engineering. The impact is limited to information leakage and does not indicate code execution or privilege escalation. No known active exploitation has been reported.
Summary
CVE-2026-87545 is an information leak vulnerability affecting Google Chrome on iOS before version 153.0.8010.36. The vulnerability allows a remote attacker to leak sensitive information by tricking a user into visiting a specially crafted HTML page. The flaw is categorized under CWE-200 (Exposure of Sensitive Information). No detailed technical exploitation methods or impact beyond information disclosure are provided.
Weaknesses
- CWE-200Exposure of Sensitive Information to an Unauthorized Actor (opens in a new tab)
Class weaknessLikelihood of exploit: HighCWE Top 25 (2025): #20OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
MITRE discourages mapping vulnerabilities to this broad entry; the root cause is usually a more specific weakness.