Google Chrome CVE-2026-87535

Requires the victim to be running Google Chrome on macOS at a version prior to 153.0.8010.36. The victim must visit a crafted HTML page (UI:R); the attacker does not need any authentication or prior access to the victim system (PR:N). Safe Browsing must be enabled, which is Chrome's default configuration - disabling it intentionally would already remove the protection this vulnerability bypasses. Exploitation is limited to macOS; Chrome on Windows or Linux is not identified as affected. No special network position, session tokens, or authenticated access to the target is required from the attacker's side.

The CVSS base score of 6.5 and Chromium's own 'Medium' severity rating are well-aligned, suggesting this is not an outlier scoring disagreement. The EPSS of 0.20% (10th percentile) is very low, indicating limited automated or opportunistic exploitation probability. No CISA KEV listing and no known POC further reduce urgency compared to the Chrome vulnerabilities in the same release cycle carrying CVSS 9.x scores and 'Critical'/'High' Chromium ratings. The integrity impact is rated High because bypassing Safe Browsing removes a key defense layer - an attacker could route victims to phishing pages or drive-by download sites without Chrome interstitial warnings - but this is a defense-in-depth bypass rather than direct code execution. Real-world risk is therefore moderate and primarily relevant to organizations relying on Safe Browsing as a last-line control for Mac Chrome fleets; the platform restriction to macOS further limits the aggregate attack surface relative to cross-platform Chrome flaws.

An attacker registers or compromises a website and serves a crafted HTML page designed to trigger the Safebrowsing information omission flaw. A macOS user running Chrome prior to 153.0.8010.36 visits the page - for example via a phishing link - and Chrome's Safe Browsing check silently fails to generate the expected interstitial warning, allowing the malicious page or associated download to proceed unchallenged. No public exploit code exists and no active exploitation has been reported, making this a lower-urgency but legitimate defense-in-depth gap for Mac Chrome users.