CVE-2026-87518 in Chrome
Summary
by MITRE • 09/09/2026
Observable discrepancy in Safebrowsing in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified within Google Chrome for iOS, specifically in versions prior to 153.0.8010.36, represents a significant breach of the browser's sandboxing architecture. This flaw is categorized under CWE-200 as an Information Exposure issue, where sensitive data becomes accessible to unauthorized entities due to improper handling or disclosure mechanisms. The core technical deficiency lies in how the Safebrowsing subsystem interacts with the renderer process during URL verification and threat detection operations. While Chrome employs a multi-process architecture designed to isolate untrusted web content from critical system resources, this specific discrepancy allowed for an observable leak of internal state information when processing crafted HTML pages.
The operational mechanism of this vulnerability relies on the attacker having already achieved code execution within the renderer process, typically through a separate initial exploit such as a cross-site scripting attack or a memory corruption flaw in web content rendering components. Once inside the sandboxed renderer environment, an adversary can construct specific HTTP requests and HTML payloads that trigger irregularities in the Safebrowsing client's response behavior. These discrepancies manifest as timing variations, distinct error codes, or unexpected data structures returned to the renderer process during local database lookups against Google’s threat intelligence feeds. By carefully analyzing these observable differences, a remote attacker can infer whether specific URLs exist within the browser’s locally cached safe browsing lists or deduce details about the user's browsing history and visited domains that should remain opaque to web content.
This capability effectively undermines the principle of least privilege enforced by Chrome’s security model on iOS devices. Although the renderer process is already compromised, which might seem like a severe initial compromise, the ability to exfiltrate information via Safebrowsing discrepancies expands the attack surface significantly. It allows for passive reconnaissance where an attacker can map out user activity without triggering explicit alerts or requiring further complex exploitation techniques. This side-channel-like behavior enables precise enumeration of visited sites, potentially revealing sensitive personal interests, financial activities, or corporate secrets that were previously protected by the browser's privacy boundaries.
From a threat intelligence perspective, this vulnerability aligns with ATT&CK technique T1078, Valid Accounts, if leveraged in conjunction with session hijacking, but more accurately reflects T1560, Archive Collected Data, and potentially aspects of T1048, Exfiltration Over Alternative Protocol. The attacker utilizes the legitimate Safebrowsing API as a covert channel to gather intelligence about the victim’s digital footprint. This is particularly dangerous on mobile platforms where users often maintain persistent sessions across multiple services, making any leakage of browsing history highly valuable for targeted phishing or social engineering campaigns.
Mitigation strategies primarily involve immediate software updates to version 153.0.8010.36 or later, which addresses the underlying logic errors in the Safebrowsing client’s interaction with the renderer process. Security engineers should ensure that all iOS devices running Chrome are patched promptly to close this information leakage vector. Additionally, defense-in-depth measures such as enabling strict Content Security Policies (CSP) and utilizing browser extensions that restrict cross-origin data access can help mitigate the impact of any initial renderer compromise. Monitoring for unusual patterns in Safebrowsing API calls or excessive network traffic related to threat checks may also aid in detecting active exploitation attempts by security operations centers managing enterprise fleets of iOS devices.