CVE-2026-87535: Google Chrome Auth Bypass Vulnerability

CVE-2026-87535 Overview

CVE-2026-87535 is an information loss or omission vulnerability in the Safebrowsing component of Google Chrome on macOS. Versions prior to 153.0.8010.36 allow a remote attacker to bypass system access restrictions by serving a crafted HTML page to a targeted user. Google classifies the Chromium security severity as Medium. The flaw is tracked under CWE-221: Information Loss or Omission and requires user interaction, such as visiting a malicious page.

Critical Impact
An attacker can bypass macOS access restrictions enforced through Chrome Safebrowsing warnings, enabling users to be tricked into executing or accessing resources they would otherwise be blocked from.

Affected Products

Google Chrome on macOS versions prior to 153.0.8010.36
Chromium-based browsers on macOS that inherit the Safebrowsing component before the patched version
Managed Chrome deployments on macOS endpoints without the Stable Channel update applied

Discovery Timeline

2026-09-09 - CVE-2026-87535 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database
2026-09-10 - EPSS score recorded at 0.202% (percentile 10.14)

Technical Details for CVE-2026-87535

Vulnerability Analysis

The vulnerability resides in Chrome's Safebrowsing subsystem on macOS. Safebrowsing is designed to warn users about dangerous downloads, deceptive sites, and content that violates system access boundaries. Under specific conditions triggered by a crafted HTML page, the component omits information required to enforce those checks. The result is a bypass of system access restrictions that Safebrowsing would normally apply.

Exploitation requires user interaction, consistent with the attack scenario of navigating to attacker-controlled content. Confidentiality is not directly impacted, but integrity is affected because the security decision produced by Safebrowsing is incorrect. Attackers can pair this bypass with social engineering to increase the likelihood of a user proceeding with a restricted action.

Root Cause

The root cause is categorized as CWE-221: Information Loss or Omission. The Safebrowsing logic on macOS fails to preserve or propagate specific state needed to evaluate access restrictions when handling a crafted page. Without that information, the enforcement path returns an outcome that permits the restricted action.

Attack Vector

The attack vector is network-based. A remote attacker hosts a crafted HTML page and lures the user to visit it in a vulnerable version of Chrome on macOS. When the browser processes the page, Safebrowsing does not enforce the expected restriction. Full technical details are limited to the vendor issue tracker. See the Chromium Issue Tracker entry #520572550 and the Google Chrome Stable Update announcement for vendor-published context.

No public proof-of-concept code is available. A prose-only description is provided in line with vendor disclosure practices for Chromium issues that remain access-restricted at publication time.

Detection Methods for CVE-2026-87535

Indicators of Compromise

Chrome browser telemetry on macOS reporting installed versions earlier than 153.0.8010.36
Navigation events to unfamiliar external domains immediately preceding execution of downloaded content or macOS system prompts
Safebrowsing telemetry gaps where an expected block or warning event is missing from browser logs

Detection Strategies

Inventory managed macOS endpoints and identify Chrome installations running below the patched build
Correlate browser process activity with subsequent file writes, quarantine bypasses, and LaunchServices invocations for downloaded artifacts
Alert on user navigation to newly registered or low-reputation domains followed by execution of downloaded HTML, scripts, or application bundles

Monitoring Recommendations

Ingest Chrome enterprise reporting into a centralized SIEM to track version drift and Safebrowsing verdicts on macOS fleets
Monitor macOS Gatekeeper, XProtect, and quarantine attribute changes for files sourced from Chrome downloads
Track outbound HTTP requests from Chrome to domains not present in allowlists, particularly requests that deliver HTML with active content

How to Mitigate CVE-2026-87535

Immediate Actions Required

Update Google Chrome on all macOS endpoints to version 153.0.8010.36 or later
Enforce automatic Chrome updates through mobile device management (MDM) or Chrome Browser Cloud Management
Verify Safebrowsing is enabled and set to Enhanced Protection where policy permits

Patch Information

Google addressed the issue in the Chrome Stable Channel release documented in the Google Chrome Stable Update announcement. Apply the update to reach version 153.0.8010.36 or later on macOS. Chromium-derived browsers should pull the corresponding upstream fix referenced in Chromium Issue #520572550.

Workarounds

Restrict user access to untrusted websites through DNS filtering or secure web gateway policies until patching completes
Disable execution of downloaded content on macOS endpoints via Gatekeeper policies and application allowlisting
Deliver targeted user awareness guidance warning against interacting with unsolicited links on macOS Chrome installations pending update

bash

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Force Chrome update via MDM-managed policy (example plist key)
defaults write com.google.Keystone.Agent checkInterval -int 3600