CVE-2026-87518: Observable discrepancy in Google Chrome

CVE-2026-87518 describes a vulnerability in Google Chrome on iOS where an observable discrepancy in the Safe Browsing component allows a remote attacker, with control over the renderer process, to potentially extract sensitive information by delivering a specially crafted HTML page. The vulnerability affects Chrome versions before 153.0.8010.36 on iOS. The Chromium security team has assigned a medium severity rating to this issue. There is no CVSS score or explicit remediation level provided in the data, but a vendor advisory URL is available for further details.

If exploited, an attacker who has already compromised the renderer process could leverage this vulnerability to obtain sensitive information from the browser environment. The impact is limited to scenarios where the renderer process is compromised, and the attacker can deliver crafted HTML content to trigger the information leak. The severity is medium, indicating a moderate risk level.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html for current remediation guidance. Since no explicit remediation level or patch link is provided, users should monitor official Google Chrome updates and apply the update to version 153.0.8010.36 or later once available.