Chrome · Safebrowsing
CVE-2026-87600
Logic Error in Safebrowsing
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Background
- `CVE-2026-87600`
- A medium-severity
LogicErrorcategorized as improper input validation in the Chrome Safebrowsing component. - Safebrowsing
- Chrome’s service that checks URLs and downloads against Google’s threat lists to warn users away from malicious or deceptive content.
- Autoroll
- An automated bot commit that mechanically advances a pinned dependency revision without human-authored code changes.
- `src/clank`
- The
DEPSentry pinning Chrome’s closed-source Android internal repository (clank/internal/apps) into the publicchromium/srccheckout.
Root Cause Analysis
The commit associated with this CVE (
60af3ed4b83a, on repo apps) is a chromium-internal-autoroll roll that only edits the DEPS file and the clank submodule gitlink, advancing the src/clank pin from 9924b3ae796f to 60af3ed4b83a. The substantive Safebrowsing input-validation fix lives inside the closed-source clank/internal/apps repository referenced by that pin and is therefore not present in this public diff, so the exact vulnerable code path, the violated invariant, and the corrective logic cannot be identified from the material provided. What the metadata does support is that the defect is a LogicError arising from improper input validation in Safebrowsing, meaning some untrusted input reached a code path that failed to validate it before use. Because the fix is delivered as an opaque revision bump, the diff shows only that a new internal revision was landed under Bug: chromium:517339356, not what that revision changed. Any claim about the specific function, data structure, or check that was corrected would be speculation beyond what the diff and metadata ground.Key insight
The single identifiable fact is that the fix is not in this commit at all: this is a
DEPS/submodule autoroll that pulls in a corrected clank/internal/apps revision, so the actual missing input validation in Safebrowsing was fixed inside Chrome’s closed-source Android repository, not in any file visible here.Attack Path
- Untrusted input reaches Safebrowsing An attacker supplies data (for example a URL or associated metadata) that flows into the affected Safebrowsing code path on Android.
- Validation is missing The pre-fix Safebrowsing logic fails to properly validate that input before acting on it, consistent with the improper-input-validation classification.
- Logic error is triggered The malformed or unexpected input drives the component into an incorrect state or decision, the concrete effect of which is not disclosed in this public diff.
- Fix pulled in via roll
The corrected
clank/internal/appsrevision60af3ed4b83aadds the missing validation, and the autoroll updatessrc/clankto ship it.
Impact Assessment
Per the metadata, this is a medium-severity improper-input-validation
LogicError in the Safebrowsing component of Chrome on Android; no cvss, cwe, or exploit primitive is specified, and none can be derived from the roll diff. An attacker’s concrete gain, the affected process or renderer/browser context, and the exact preconditions are not determinable from the provided material because the fixing code is closed-source and absent here. The only grounded statement is that the flaw weakened Safebrowsing’s handling of untrusted input until the rolled-in internal revision restored proper validation.Files Changed
DEPSclank
Audit Directions
- Opaque internal rollsWhen a CVE maps to a
chromium-internal-autorollDEPS/submodule bump, treat the public diff as insufficient and seek the fix in the referenced closed-source repository (clank/internal/apps) rather than inferring code changes. - Safebrowsing input boundariesReview Safebrowsing entry points that parse or dispatch on untrusted URL and metadata input, checking that each validates length, type, and range before use.
- Bug-ID pivotingUse the
Bug: chromium:517339356reference to correlate the roll with the actual internal fix and confirm which Safebrowsing code path was hardened before drawing conclusions.
Patch
From dd2eb5b34a1fe5c885d659bf49fccc024ded13fa Mon Sep 17 00:00:00 2001
From: chromium-internal-autoroll@skia-corp.google.com.iam.gserviceaccount.com <chromium-internal-autoroll@skia-corp.google.com.iam.gserviceaccount.com>
Date: Fri, 07 Aug 2026 12:17:02 -0700
Subject: [PATCH] Roll clank/internal/apps from 9924b3ae796f to 60af3ed4b83a (1 revision)
https://chrome-internal.googlesource.com/clank/internal/apps.git/+log/9924b3ae796f..60af3ed4b83a
If this roll has caused a breakage, revert this CL and stop the roller
using the controls here:
https://skia-autoroll.corp.goog/r/clank-apps-chromium-autoroll
Please CC chrome-brapp-engprod@google.com,skavuluru@google.com on the revert to ensure that a human
is aware of the problem.
To report a problem with the AutoRoller itself, please file a bug:
https://issues.skia.org/issues/new?component=1389291&template=1850622
Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+doc/main/autoroll/README.md
Bug: chromium:517339356
Tbr: skavuluru@google.com
No-Try: true
Change-Id: Id9e3a6533226a146c8276c610685888bcdd91421
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8222235
Bot-Commit: chromium-internal-autoroll@skia-corp.google.com.iam.gserviceaccount.com <chromium-internal-autoroll@skia-corp.google.com.iam.gserviceaccount.com>
Commit-Queue: chromium-internal-autoroll@skia-corp.google.com.iam.gserviceaccount.com <chromium-internal-autoroll@skia-corp.google.com.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#1675882}
---
diff --git a/DEPS b/DEPS
index 07175f7..1761c678 100644
--- a/DEPS
+++ b/DEPS
@@ -1722,7 +1722,7 @@
'src/clank': {
'url': Var('chrome_git') + '/clank/internal/apps.git' + '@' +
- '9924b3ae796f1ead39f335234c232c4226e25c0f',
+ '60af3ed4b83a012447f9a27fad47768a55e80fb3',
'condition': 'checkout_android and checkout_src_internal',
},
diff --git a/clank b/clank
index 9924b3a..60af3ed 160000
--- a/clank
+++ b/clank
@@ -1 +1 @@
-Subproject commit 9924b3ae796f1ead39f335234c232c4226e25c0f
+Subproject commit 60af3ed4b83a012447f9a27fad47768a55e80fb3
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page