CVE-2026-87640: Medium severity Google Chrome (Android WebView) vulnerability
Chromium CVE-2026-87640: Out of bounds read in WebView
Other sources
Out of bounds read in WebView in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
— MITRE
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 153.0.4234.32 - Upgrade
Upgrade
Google Chrome for Androidto a version that resolves this vulnerability.Fixed in 153.0.8010.36
Event History
Frequently Asked Questions
Who is exposed to this issue?
Android deployments using Google Chrome Android WebView versions earlier than 153.0.8010.36 are affected. The issue concerns WebView rather than the desktop Chrome product.
What does an attacker need to exploit it?
The attacker must first compromise the renderer process. They can then use a crafted HTML page to trigger an out-of-bounds read and access memory outside the sandbox.