CVE-2026-87546: Google Chrome Auth Bypass Vulnerability

CVE-2026-87546 Overview

CVE-2026-87546 is an incorrect type conversion or cast vulnerability in the Safe Browsing component of Google Chrome on macOS. The flaw affects Chrome versions prior to 153.0.8010.36 and allows a remote attacker to bypass system access restrictions by delivering a crafted file. Exploitation requires user interaction, such as opening or downloading the malicious file through the browser. Google classifies the underlying Chromium severity as Low, while the NVD assessment aligns with a medium-severity network-exploitable issue affecting integrity. The weakness is tracked under CWE-704 (Incorrect Type Conversion or Cast).

Critical Impact
A remote attacker can bypass macOS system access restrictions enforced through Chrome Safe Browsing by delivering a crafted file to a user, undermining a key browser-layer defense against malicious downloads.

Affected Products

Google Chrome on macOS prior to 153.0.8010.36
Apple macOS (as the host platform where Safe Browsing restrictions are bypassed)
Chromium-based deployments on macOS that inherit the vulnerable Safe Browsing code path

Discovery Timeline

2026-09-09 - CVE-2026-87546 published to the National Vulnerability Database (NVD)
2026-09-10 - Last updated in the NVD database

Technical Details for CVE-2026-87546

Vulnerability Analysis

The defect resides in Chrome's Safe Browsing component, which is responsible for evaluating downloaded files and warning users about potentially unsafe content. An incorrect type conversion or cast within this component causes the code to interpret an object or file attribute as a different type than what was originally supplied. When a crafted file is processed along the affected code path, the mistyped value drives decision logic that ordinarily enforces macOS system access restrictions. As a result, the safety check can be circumvented and the file is treated as though it satisfied a policy that it does not actually meet. The impact is limited to integrity of the browser's protective boundary; the issue does not directly expose confidential data or crash the browser.

Root Cause

The root cause is a [CWE-704] Incorrect Type Conversion or Cast in the Safe Browsing subsystem of Google Chrome on macOS. Object attributes derived from attacker-controllable file input are cast to an unintended type before being consumed by access-restriction logic. The mismatched interpretation lets a specially constructed file traverse a decision branch that should have been rejected, producing a security decision that does not reflect the file's actual properties.

Attack Vector

The attack vector is network-based with required user interaction. An attacker hosts or delivers a crafted file, for example via a malicious website, phishing link, or attachment. When the user downloads or opens the file through a vulnerable Chrome build on macOS, the flawed Safe Browsing check misclassifies the file and allows it to bypass restrictions that would normally gate its execution or handling. No authentication is required, and the attacker does not need local access to the target machine. Refer to the Chromium Issue #517926950 tracker and the Chrome Desktop Update September 2026 advisory for vendor context. Verified public exploit code is not available at the time of publication.

Detection Methods for CVE-2026-87546

Indicators of Compromise

Chrome browser processes on macOS endpoints running versions earlier than 153.0.8010.36 while handling downloaded files from untrusted origins.
Downloaded files with mismatched or inconsistent MIME types, file extensions, and macOS quarantine attributes recorded in browser telemetry.
Post-download execution of binaries or scripts on macOS that lack the expected com.apple.quarantine extended attribute despite arriving via Chrome.

Detection Strategies

Inventory Chrome installations across macOS fleets and flag hosts running versions below 153.0.8010.36.
Correlate browser download events with subsequent process launches on macOS to detect files that evade Safe Browsing warnings and immediately execute.
Alert on Chrome-delivered files that trigger Gatekeeper or XProtect events shortly after download, which may indicate a bypass attempt against the Safe Browsing decision path.

Monitoring Recommendations

Ingest macOS endpoint telemetry, including process creation, file quarantine metadata, and browser download logs, into a centralized analytics platform for correlation.
Monitor outbound connections to newly registered or low-reputation domains that serve executable content to Chrome clients.
Track Chrome update posture as a continuous compliance signal and generate alerts when macOS endpoints fall behind the fixed version.

How to Mitigate CVE-2026-87546

Immediate Actions Required

Update Google Chrome on all macOS endpoints to version 153.0.8010.36 or later as published in the Chrome Desktop Update September 2026 advisory.
Force-restart Chrome after deployment to ensure the patched binaries are loaded, since Chrome applies updates only on relaunch.
Audit managed macOS devices to confirm the fixed version is running and remediate any lagging endpoints.

Patch Information

Google addressed the vulnerability in the Stable channel release 153.0.8010.36 for macOS. Administrators managing Chrome through MDM or Google's enterprise policies should validate that automatic updates are enabled and that the Stable channel is targeted. Technical background is available in Chromium Issue #517926950.

Workarounds

Restrict downloads of unknown file types in Chrome using enterprise policies such as DownloadRestrictions until patching is complete.
Educate users to avoid opening files from untrusted sources and to verify download prompts, given that exploitation requires user interaction.
Enforce application allowlisting on macOS via Gatekeeper and code signing policies so that files bypassing Safe Browsing still face an additional execution barrier.

bash

# Configuration example: enforce Chrome download restrictions on managed macOS endpoints
# Blocks potentially dangerous downloads (value 2) via Chrome enterprise policy
defaults write com.google.Chrome DownloadRestrictions -int 2

# Verify installed Chrome version meets or exceeds the fixed build
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version