CVE-2026-87627
Google Chrome ≤ 153.0.8010.36
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-87627 is a medium-severity Interpretation Conflict (CWE-436) vulnerability in Google Chrome. Its CVSS base score is 6.5 (Medium).
Operationally, ranked at the 19th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-74445
Vulnerability Data
Interpretation conflict in Safebrowsing in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted file. (Chromium security severity: Low)
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover cases where two products interpret the same inputs or state transitions differently.
Strict, consistently applied input validation reduces the chance that one product will accept data the other product rejects or interprets differently.
Applying security engineering principles during design can require unambiguous protocol and data-format specifications that eliminate divergent interpretations between products.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.8.25 mandates a secure SDLC process with checkpoints, secure coding, testing and training; it does not stop differing interpretations of shared state or inputs between two products from arising or being exploited
A.8.26 only requires that security requirements (including resilience against injections or input controls) be identified and specified during development or acquisition; it does not itself enforce, implement or assure any mechanism that stops an interpretation conflict from being exploitable.
A.8.27 establishes and applies secure-by-design principles (defense-in-depth, least privilege, assume-breach, distrust-external-input, hardening, etc.) but does not stop two products from interpreting the same input or protocol step differently; the resulting state/conflict weakness can still be present and exploitable.
Secure coding standards can enforce canonical input handling and strict protocol compliance to avoid misinterpretation between products.
Security testing can detect and correct cases where one component misinterprets another’s state or messages.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.
- No fine-grained STIG row for CWE-436, a class-level weakness, and none of its children carries one either.