CVE-2026-87627: Google Chrome Safebrowsing Auth Bypass

CVE-2026-87627 Overview

CVE-2026-87627 is an interpretation conflict vulnerability [CWE-436] in the Safebrowsing component of Google Chrome on macOS. The flaw affects Chrome versions prior to 153.0.8010.36. A remote attacker who convinces a user to open a crafted file can bypass macOS system access restrictions. Google classifies the Chromium security severity as Low. The Safebrowsing subsystem and the operating system interpret the same file differently, allowing content that Safebrowsing considers benign to be treated as trusted by macOS. Exploitation requires social engineering because the user must interact with the crafted file.

Critical Impact
Successful exploitation lets a remote attacker circumvent macOS access controls such as Gatekeeper or Quarantine when a user opens a specially crafted file delivered through Chrome.

Affected Products

Google Chrome for macOS prior to 153.0.8010.36
Chromium-based components using the affected Safebrowsing logic on macOS
Downstream browsers built on the same Chromium branch (verify with vendor)

Discovery Timeline

2026-09-09 - CVE-2026-87627 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87627

Vulnerability Analysis

The issue is an interpretation conflict [CWE-436] between the Chrome Safebrowsing component and macOS file-handling subsystems. Two components parse or classify the same downloaded artifact using different rules. The result is inconsistent trust decisions across the download and execution path. An attacker abuses this gap to deliver a file that Safebrowsing does not flag but macOS treats without the expected access restrictions. The vulnerability requires user interaction driven by social engineering, so exploitation depends on the victim opening the crafted file.

Root Cause

The root cause is divergent file interpretation between Chrome's Safebrowsing pipeline and macOS security controls. Safebrowsing evaluates file type, reputation, and threat signals using its own logic. macOS applies quarantine attributes, Gatekeeper checks, and MIME resolution using separate logic. When these interpretations disagree, a file can pass Safebrowsing scrutiny while landing on disk without the intended access restrictions.

Attack Vector

Exploitation is remote but requires user interaction. An attacker hosts or delivers a crafted file that targets the interpretation gap. The victim downloads and opens the file through Chrome on macOS. Because Safebrowsing does not flag the artifact, no protective warning is shown. macOS then processes the file with weaker restrictions than a correctly interpreted file would receive. Public exploit code is not currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified proof-of-concept code is publicly available. For technical detail, refer to the Chromium Issue Tracker #513473551 and the Google Chrome Stable Update advisory.

Detection Methods for CVE-2026-87627

Indicators of Compromise

Unexpected files downloaded through Chrome on macOS that execute without a Gatekeeper prompt
Files on disk missing the com.apple.quarantine extended attribute after being downloaded by Chrome
Chrome download history entries pointing to files delivered from low-reputation domains that were not flagged by Safebrowsing

Detection Strategies

Inventory macOS endpoints and identify Chrome installations at versions earlier than 153.0.8010.36
Monitor file downloads by the Chrome process and compare extended attributes and MIME types against expected values
Correlate browser telemetry with process execution events for files opened shortly after download

Monitoring Recommendations

Alert on macOS process launches originating from Chrome download directories without quarantine metadata
Track Chrome auto-update status across the fleet to confirm patched builds are deployed
Ingest browser and endpoint telemetry into a centralized data lake for cross-source correlation and retrospective hunts

How to Mitigate CVE-2026-87627

Immediate Actions Required

Update Google Chrome on macOS to version 153.0.8010.36 or later
Enable and verify Chrome auto-update on all managed macOS endpoints
Reinforce user awareness on opening files from untrusted sources delivered via the browser

Patch Information

Google released the fix in the Chrome Stable channel update documented in the Chrome Releases blog. Administrators should confirm deployment of Chrome 153.0.8010.36 or later on all macOS systems. The underlying issue is tracked in Chromium Issue #513473551.

Workarounds

Restrict downloads from untrusted sites through enterprise browser policy until patching is complete
Enforce Gatekeeper policies on macOS to require signed and notarized applications
Use managed configuration to require Safebrowsing enhanced protection on Chrome for macOS

bash

# Verify Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Confirm the com.apple.quarantine attribute is present on downloaded files
xattr -p com.apple.quarantine ~/Downloads/suspicious-file

# Enforce Gatekeeper (requires administrator privileges)
sudo spctl --master-enable