CVE-2026-87517: Google Chrome iOS Race Condition Vulnerability

CVE-2026-87517 Overview

CVE-2026-87517 is a race condition vulnerability in the Mobile component of Google Chrome on iOS prior to version 153.0.8010.36. The flaw allows a remote attacker to bypass the web origin policy through a crafted HTML page, provided the victim is lured through social engineering. The Chromium project rated the underlying issue with a High security severity, while the assigned CVSS 3.1 base score reflects lower exploitability due to attack complexity and required user interaction. The vulnerability is tracked under CWE-367: Time-of-Check Time-of-Use (TOCTOU) Race Condition.

Critical Impact
Successful exploitation lets a remote attacker circumvent same-origin protections in the browser, exposing cross-origin data to attacker-controlled pages.

Affected Products

Google Chrome for iOS versions prior to 153.0.8010.36
Apple iOS devices running vulnerable Chrome builds
Any deployment relying on Chrome for iOS as a managed browser

Discovery Timeline

2026-09-09 - CVE-2026-87517 published to the National Vulnerability Database
2026-09-09 - Last updated in the NVD database

Technical Details for CVE-2026-87517

Vulnerability Analysis

The vulnerability resides in the Mobile component of Chrome on iOS. A race condition [CWE-367] enables an attacker to manipulate the timing between a security check and the subsequent use of the checked resource. When a crafted HTML page triggers concurrent navigation or resource-loading events, the browser can apply origin decisions to a state that has already changed, resulting in a web origin policy bypass.

Exploitation requires user interaction such as visiting an attacker-controlled URL or clicking a crafted link. The scope remains unchanged, and the impact is limited to confidentiality of data reachable through cross-origin access. No integrity or availability impact is documented. Public exploit code is not available, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is a TOCTOU condition in code paths that enforce web origin boundaries on iOS. Origin state consulted during a validation step is not stably bound to the operation that follows, allowing a competing event to alter the effective origin before enforcement completes. Google addressed the defect in the Stable channel update referenced in the Chromium Issue Tracker #517581661.

Attack Vector

The attack is network-based and requires the victim to load a crafted HTML page in vulnerable Chrome for iOS. The attacker relies on social engineering to induce navigation or interaction with the payload. Because the flaw requires winning a timing race, exploitation complexity is elevated. Once the race is won, the attacker can read data across origin boundaries that same-origin policy would normally block.

No authenticated code execution or elevated privileges are required on the target device. Technical details are limited in public sources. See the Google Chrome Stable Update for additional context.

Detection Methods for CVE-2026-87517

Indicators of Compromise

Unexpected navigation events from Chrome on iOS to unfamiliar or newly registered domains that host HTML payloads.
Browser telemetry showing rapid, concurrent navigation or iframe load events immediately preceded by a social-engineering lure such as a phishing message.
Outbound requests carrying data from sensitive origins to third-party endpoints shortly after a suspicious page visit.

Detection Strategies

Inventory Chrome for iOS installations and flag any device running a version below 153.0.8010.36.
Correlate mobile web-proxy logs with email and messaging gateways to identify users who followed suspicious links into crafted HTML pages.
Alert on anomalous cross-origin request patterns originating from mobile browsers, particularly bursts of asynchronous requests to attacker-controlled hosts.

Monitoring Recommendations

Enable and forward mobile browser and MDM telemetry to a centralized analytics platform for continuous version and behavior monitoring.
Track phishing and smishing campaigns targeting iOS users and correlate reported URLs with browser navigation events.
Review DNS and TLS SNI logs for connections to newly registered or low-reputation domains from managed iOS devices.

How to Mitigate CVE-2026-87517

Immediate Actions Required

Update Google Chrome on iOS to version 153.0.8010.36 or later through the Apple App Store.
Push the updated Chrome build to managed iOS devices via mobile device management (MDM) with enforcement policies.
Communicate phishing-awareness guidance to users, emphasizing risks associated with unsolicited links on mobile devices.

Patch Information

Google released the fix in the Chrome Stable channel documented in the Google Chrome Stable Update. Users should install Chrome for iOS version 153.0.8010.36 or later. Tracking details are available in the Chromium Issue Tracker #517581661.

Workarounds

Restrict use of Chrome for iOS on managed devices until the patched version is installed.
Route mobile browsing through a secure web gateway that blocks known phishing infrastructure and newly registered domains.
Enforce MDM policies that prevent installation or launch of Chrome versions older than 153.0.8010.36.

bash

# Example MDM version-enforcement check (pseudocode)
if [ "$(chrome_ios_version)" \< "153.0.8010.36" ]; then
  mdm_action --block-app com.google.chrome.ios
  mdm_action --notify-user "Update Chrome to 153.0.8010.36 or later"
fi