CVE-2026-87535 in Chrome
Summary
by MITRE • 09/09/2026
Information loss or omission in Safebrowsing in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified within the Google Chrome browser, specifically affecting versions of Safebrowsing on macOS prior to build 153.0.8010.36, represents a critical failure in the integrity and completeness of data handling during threat detection processes. This flaw is categorized under CWE-209 as an Information Exposure Through an Error Message or through Omission of Sensitive Information, although in this specific context, it manifests more accurately as CWE-778 Insufficient Logging or Monitoring leading to a bypass of security controls. The core technical issue lies in the Safebrowsing component's inability to properly process or retain certain indicators of compromise when evaluating remote URLs against Google’s threat intelligence databases. When a user navigates to a malicious site, the browser is designed to intercept the request, query the safe browsing service, and block access if a match is found. However, due to this omission error, specific crafted HTML pages could trigger conditions where the Safebrowsing subsystem fails to register or report the threat status correctly back to the rendering engine.
This technical flaw allows for a remote code execution bypass scenario that falls under MITRE ATT&CK technique T1071 Application Layer Protocol, specifically web protocols like HTTP and HTTPS. By crafting an HTML page with specific structural anomalies or encoding tricks, an attacker can exploit the gap in information processing where the browser’s security filters do not receive the necessary context to enforce access restrictions. The result is that the system treats a known malicious domain as safe, effectively neutralizing one of Chrome's primary defense mechanisms against phishing and malware distribution sites. This bypass does not require local user interaction beyond clicking a link or loading a page in an existing tab, making it highly exploitable for drive-by download attacks or credential harvesting campaigns targeting macOS users who rely on the browser’s built-in protections.
The operational impact of this vulnerability is significant because it undermines the trust model inherent to modern web browsers. Users expect that when they encounter a red warning screen indicating a dangerous site, their system is protected from further interaction with that threat. In this case, the absence of proper information handling means that users may be silently redirected or allowed to proceed onto sites designed to exploit other vulnerabilities in plugins, extensions, or the operating system itself. For enterprise environments relying on Chrome for secure browsing, this creates a blind spot where endpoint detection and response systems might not trigger alerts because the browser does not log the blocked attempt as expected due to the internal omission error. This can lead to successful initial access by threat actors who leverage social engineering combined with technical exploitation of this specific flaw in the Safebrowsing logic.
Mitigation strategies must prioritize immediate patching to version 153.0.8010.36 or later, which addresses the underlying code path responsible for the information omission. Administrators should ensure that automatic updates are enabled for Chrome on all macOS endpoints to guarantee timely application of security fixes. In addition to software remediation, organizations should implement network-level filtering solutions such as DNS sinkholing or proxy-based web content filters that operate independently of the browser’s internal Safebrowsing client. These external controls provide a secondary layer of defense, ensuring that even if the browser fails to block a malicious URL due to this vulnerability, the network infrastructure will still prevent connectivity to known bad actors. Regular auditing of browser configurations and monitoring for unusual outbound traffic patterns can also help detect attempts to exploit this specific flaw before significant damage occurs.