PatchGap
Chrome · Safebrowsing

CVE-2026-87600

Input Validation in Safebrowsing
Medium watch CVSS 6.5 chrome Input Validation

Overview

Medium
Severity
6.5
CVSS
No
Exploited ITW
Embargoed
Fix Status
ImpactImproper input validation in Safebrowsing
DescriptionImproper input validation in Safebrowsing
ComponentSafebrowsing
Bug ClassInput Validation
Action tierwatch — logic/policy bug — security-relevant, no memory-unsafety
Computed by PatchGap's deterministic exploitability ruler from the fixing commit. patch-now = RCE-class & attacker-reachable in a default config, or exploited in the wild; watch = real security signal below that bar; noise = no security relevance.
Tracker517339356
CWECWE-20 (Improper input validation)
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CISA KEVNot listed
CreditedGoogle
Reported2026-05-28 (per vendor advisory)
Disclosed2026-09-08

Fix not yet public

No public source fix for this bug has been identified on the main branch yet — it is embargoed or not yet disclosed. Root-cause analysis is withheld until the fix commit is available.

Background

`CVE-2026-87600`
A medium-severity LogicError categorized as improper input validation in the Chrome Safebrowsing component.
Safebrowsing
Chrome’s service that checks URLs and downloads against Google’s threat lists to warn users away from malicious or deceptive content.
Autoroll
An automated bot commit that mechanically advances a pinned dependency revision without human-authored code changes.
`src/clank`
The DEPS entry pinning Chrome’s closed-source Android internal repository (clank/internal/apps) into the public chromium/src checkout.
Key insight
The single identifiable fact is that the fix is not in this commit at all: this is a DEPS/submodule autoroll that pulls in a corrected clank/internal/apps revision, so the actual missing input validation in Safebrowsing was fixed inside Chrome’s closed-source Android repository, not in any file visible here.

Attack Path

  1. Untrusted input reaches Safebrowsing An attacker supplies data (for example a URL or associated metadata) that flows into the affected Safebrowsing code path on Android.
  2. Validation is missing The pre-fix Safebrowsing logic fails to properly validate that input before acting on it, consistent with the improper-input-validation classification.
  3. Logic error is triggered The malformed or unexpected input drives the component into an incorrect state or decision, the concrete effect of which is not disclosed in this public diff.
  4. Fix pulled in via roll The corrected clank/internal/apps revision 60af3ed4b83a adds the missing validation, and the autoroll updates src/clank to ship it.

Impact Assessment

Per the metadata, this is a medium-severity improper-input-validation LogicError in the Safebrowsing component of Chrome on Android; no cvss, cwe, or exploit primitive is specified, and none can be derived from the roll diff. An attacker’s concrete gain, the affected process or renderer/browser context, and the exact preconditions are not determinable from the provided material because the fixing code is closed-source and absent here. The only grounded statement is that the flaw weakened Safebrowsing’s handling of untrusted input until the rolled-in internal revision restored proper validation.

Audit Directions

  • Opaque internal rolls
    When a CVE maps to a chromium-internal-autoroll DEPS/submodule bump, treat the public diff as insufficient and seek the fix in the referenced closed-source repository (clank/internal/apps) rather than inferring code changes.
  • Safebrowsing input boundaries
    Review Safebrowsing entry points that parse or dispatch on untrusted URL and metadata input, checking that each validates length, type, and range before use.
  • Bug-ID pivoting
    Use the Bug: chromium:517339356 reference to correlate the roll with the actual internal fix and confirm which Safebrowsing code path was hardened before drawing conclusions.

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
On This Page