CVE-2026-87518: Google Chrome Information Disclosure Flaw

CVE-2026-87518 Overview

CVE-2026-87518 is an observable discrepancy vulnerability in the Safe Browsing component of Google Chrome on iOS. The flaw affects Chrome versions prior to 153.0.8010.36 and allows a remote attacker who has already compromised the renderer process to obtain sensitive information through a crafted HTML page. Google's Chromium security team classified this issue as Medium severity. The vulnerability is tracked under CWE-203: Observable Discrepancy, which covers side-channel information leaks caused by differences in observable behavior.

Critical Impact
A compromised renderer process can leverage timing or behavioral differences in Safe Browsing checks to infer sensitive browsing information on iOS devices.

Affected Products

Google Chrome on iOS prior to version 153.0.8010.36
Apple iPhone OS (all versions running vulnerable Chrome builds)
Chromium-based Safe Browsing subsystem on iOS

Discovery Timeline

2026-09-09 - CVE-2026-87518 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87518

Vulnerability Analysis

The vulnerability resides in the Safe Browsing implementation used by Google Chrome on iOS. Safe Browsing is designed to warn users when they navigate to phishing, malware, or otherwise unsafe pages. An observable discrepancy in this component means that its runtime behavior differs in ways an attacker can measure. Those measurable differences leak information about the URLs or resources being checked.

Exploitation requires that the attacker already control the renderer process. From that foothold, a crafted HTML page can trigger Safe Browsing lookups and observe the resulting side effects. The attack requires user interaction and has high attack complexity, which limits the practical exploitation surface. Successful exploitation impacts confidentiality but does not affect integrity or availability.

Root Cause

The root cause is a violation of the CWE-203 principle: sensitive operations in the Safe Browsing pipeline produce distinguishable outputs based on secret inputs. Response timing, error paths, or resource-loading behavior can reveal whether a given URL or resource matches internal Safe Browsing state. On iOS, Chrome relies on platform-provided web view infrastructure, which further constrains how Safe Browsing checks are performed and how their observability is bounded.

Attack Vector

The attack chain begins with a renderer compromise, typically obtained through a separate memory-safety or logic bug. Once the attacker controls the renderer, they deliver a crafted HTML page that issues navigation or resource requests designed to elicit measurable Safe Browsing behavior. By comparing observed responses against a reference set, the attacker infers information the renderer should not be able to access directly. Refer to the Chromium Issue Tracker Entry and the Chrome Blog Release Update for vendor-published technical context.

Detection Methods for CVE-2026-87518

Indicators of Compromise

Chrome for iOS installations reporting a version earlier than 153.0.8010.36 in mobile device management (MDM) inventory.
Repeated Safe Browsing lookup patterns originating from a single renderer, particularly in tight loops or with structured URL variations.
Unusual outbound traffic from Chrome on iOS to non-standard endpoints immediately after visiting an untrusted page.

Detection Strategies

Correlate browser telemetry with MDM version data to flag iOS devices running vulnerable Chrome builds.
Monitor for prerequisite renderer-compromise indicators, since this vulnerability requires an existing renderer foothold to be practical.
Inspect proxy and DNS logs for anomalous, rapid, or repeated navigation events consistent with side-channel probing.

Monitoring Recommendations

Enforce continuous version reporting for Chrome on iOS through MDM and alert on out-of-date deployments.
Ingest browser and network telemetry into a centralized analytics platform to correlate renderer exploitation attempts with Safe Browsing anomalies.
Track upstream Chrome release notes and Chromium issue updates to catch related follow-on advisories.

How to Mitigate CVE-2026-87518

Immediate Actions Required

Update Google Chrome on iOS to version 153.0.8010.36 or later through the Apple App Store or MDM-managed app deployment.
Audit the mobile fleet for devices still running vulnerable Chrome builds and prioritize remediation on high-risk user populations.
Reinforce user guidance to avoid clicking unsolicited links, since exploitation requires user interaction with a crafted page.

Patch Information

Google addressed CVE-2026-87518 in Chrome for iOS 153.0.8010.36. The fix is described in the Chrome Blog Release Update, and implementation details are tracked in the Chromium Issue Tracker Entry. Organizations using managed iOS deployments should push the updated Chrome build through their MDM solution and confirm installation across the fleet.

Workarounds

Restrict use of Chrome on iOS to trusted browsing scenarios until the patched version is deployed across the fleet.
Direct users to alternative iOS browsers on managed devices where Chrome cannot be updated promptly.
Apply network-layer controls such as DNS filtering to reduce exposure to crafted HTML pages hosted on untrusted domains.

bash

# Configuration example: verify Chrome for iOS version via MDM query
# Confirm installed version is >= 153.0.8010.36
mdm-cli query --app com.google.chrome.ios --field CFBundleShortVersionString