Information leak in Passwords in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to leak sensitive information via a… (CVE-2026-87565)
Source GCVE Database
Not known to be exploited.
Data as of 10/25/2026, 04:40:14 UTC
CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 23% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
What to do
AI-suggested
Users should update Google Chrome on Android to version 153.0.8010.36 or later once available to address this issue. Until an official fix is confirmed, exercise caution when visiting untrusted websites.
Description
A low severity information leak vulnerability exists in the Passwords component of Google Chrome on Android versions prior to 153.0.8010.36. This flaw allows a remote attacker to leak sensitive information by crafting a malicious HTML page. No CVSS score is provided, and no known exploits are reported in the wild. The vulnerability is identified as CWE-200, indicating exposure of sensitive information. No explicit patch or remediation details are provided in the available data.
Impact
The vulnerability allows a remote attacker to leak sensitive information related to passwords stored or managed by Google Chrome on affected Android versions. The impact is limited to information disclosure and is rated low severity by the Chromium security team. There are no reports of exploitation in the wild.
Weaknesses
- CWE-200Exposure of Sensitive Information to an Unauthorized Actor (opens in a new tab)
Class weaknessLikelihood of exploit: HighCWE Top 25 (2025): #20OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
MITRE discourages mapping vulnerabilities to this broad entry; the root cause is usually a more specific weakness.