CVE-2026-87518: Medium severity Google Chrome for iOS vulnerability
Chromium CVE-2026-87518: Observable discrepancy in Safebrowsing
Other sources
Observable discrepancy in Safebrowsing in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
— MITRE
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 153.0.4234.32 - Upgrade
Upgrade
Google Chrome on iOSto a version that resolves this vulnerability.Fixed in 153.0.8010.36
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker must already have compromised the Chrome renderer process and then use a crafted HTML page. The provided information does not indicate that visiting a malicious page alone is sufficient.
Which Chrome for iOS versions are affected?
Google Chrome for iOS versions prior to 153.0.8010.36 are affected. Updating to version 153.0.8010.36 or later addresses the affected version range.
What type of information could be exposed?
The issue could potentially allow disclosure of sensitive information through an observable Safe Browsing discrepancy. The provided information does not specify the particular data types that may be exposed.