CVE-2026-87470: Google Chrome RCE Vulnerability

CVE-2026-87470 Overview

CVE-2026-87470 is an improper quantity validation vulnerability in the Tint component of Google Chrome on macOS. Versions prior to 153.0.8010.36 are affected. A remote attacker can potentially execute arbitrary code outside the Chrome sandbox by convincing a user to visit a crafted HTML page. The vulnerability is tracked under CWE-1284 (Improper Validation of Specified Quantity in Input) and requires user interaction. Chromium classifies the underlying issue at Medium severity, while the NVD scored it at 9.6 due to sandbox escape potential and scope change.

Critical Impact
Successful exploitation allows arbitrary code execution outside the Chrome renderer sandbox on macOS, giving attackers direct access to the host operating system.

Affected Products

Google Chrome on macOS prior to 153.0.8010.36
Apple macOS (as the affected host platform)
Chromium-based downstream browsers that ship the vulnerable Tint component

Discovery Timeline

2026-09-09 - CVE-2026-87470 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87470

Vulnerability Analysis

The flaw resides in Tint, the shader translator and validator used by Chrome's graphics stack to process WebGPU and related GPU shader inputs. Tint fails to properly validate a specified quantity in an input structure. When a crafted HTML page submits a malformed shader or resource description, Tint proceeds with quantity assumptions that do not match the actual data. The mismatch enables memory corruption within the GPU process. Because the GPU process runs with broader privileges than the renderer, exploitation escapes the renderer sandbox and executes attacker-controlled code in the GPU process context on macOS.

Root Cause

The root cause is improper validation of a specified quantity in input, classified as CWE-1284. Tint accepts a length, count, or size field from an untrusted source without verifying it matches the associated buffer or descriptor. Subsequent processing operates on the unchecked quantity, producing an out-of-bounds condition that an attacker can shape into arbitrary code execution.

Attack Vector

Exploitation is remote and requires user interaction. A victim must load an attacker-controlled or compromised web page in a vulnerable Chrome build on macOS. The page delivers crafted shader or graphics-pipeline input that reaches Tint. No credentials or prior access are required. Details of the underlying bug are tracked in the Chromium Issue Tracker #536446354 and referenced in the Google Chrome Stable Update advisory.

No public proof-of-concept, exploit module, or CISA KEV listing exists for this CVE at time of writing.

Detection Methods for CVE-2026-87470

Indicators of Compromise

Chrome GPU process (Google Chrome Helper (GPU)) spawning unexpected child processes or shells on macOS endpoints.
Outbound network connections initiated by the Chrome GPU helper to unfamiliar domains shortly after browsing activity.
Unexpected file writes under ~/Library/Application Support/ or /tmp/ originating from Chrome helper processes.
Chrome crash reports referencing Tint, WebGPU, or Dawn modules preceding suspicious activity.

Detection Strategies

Inventory installed Chrome versions across macOS assets and flag any build below 153.0.8010.36.
Alert on abnormal parent-child relationships where a Chrome helper process launches interpreters such as bash, zsh, osascript, or python3.
Correlate browser crash telemetry with subsequent process creation or persistence events on the same host.

Monitoring Recommendations

Ingest macOS Endpoint Security process, file, and network events into a centralized analytics platform for behavioral review.
Track visits to newly registered or low-reputation domains immediately preceding Chrome helper anomalies.
Monitor for creation of new LaunchAgents or LaunchDaemons following Chrome sessions as a post-exploitation persistence signal.

How to Mitigate CVE-2026-87470

Immediate Actions Required

Update Google Chrome on macOS to version 153.0.8010.36 or later on all managed endpoints.
Force-restart Chrome after the update so the patched binaries load; running instances remain vulnerable.
Audit Chromium-based browsers and Electron applications that embed Tint or Dawn and apply vendor updates when available.

Patch Information

Google released the fix in the Chrome Stable channel. Refer to the Google Chrome Stable Update advisory for the full changelog. Enterprise administrators should deploy through MDM tooling such as Jamf, Kandji, or Intune, or via the Chrome Enterprise update policies. Verify the installed version by navigating to chrome://settings/help and confirming 153.0.8010.36 or later.

Workarounds

Disable WebGPU via the enterprise policy or chrome://flags/#enable-unsafe-webgpu where hardware acceleration is not business-critical.
Restrict browsing to trusted sites through URL allowlists until patching is complete.
Deploy the DefaultJavaScriptSetting and site isolation policies to limit exposure from untrusted content.

bash

# Configuration example: verify Chrome version on macOS endpoints
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Enterprise policy snippet to disable WebGPU (managed preferences)
defaults write com.google.Chrome DefaultWebUsbGuardSetting -int 2
defaults write com.google.Chrome HardwareAccelerationModeEnabled -bool false