External risk intelligence

Chrome Tint Improper Quantity Validation Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-87470

The vulnerability exists within a web browser, which is a client-side application inherently designed to process and render arbitrary content from the public internet. While it requires user interaction, the product's primary role is to act as an interface for internet-based services and web pages, making exposure to untrusted external content a standard and expected deployment pattern.

Google Chrome

before 153.0.8010.36

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in Google Chrome's rendering engine could allow a remote attacker to execute code outside the browser's protected environment by tricking a user into visiting a malicious web page. While the severity is rated as critical, the primary concern is confirming whether our specific environment and usage patterns are exposed.

Website flaws can allow code execution.
Browser vulnerabilities affect broad user bases.
Confirm exposure and review mitigation options.

Attack Path

How an attacker could exploit the issue

An attacker could trick a user into visiting a malicious HTML page that exploits a flaw in how Google Chrome handles quantities within its Tint component. This could allow the attacker to execute code beyond the browser's security boundaries.

User visits a crafted HTML page.
Improper quantity validation in Tint.
Arbitrary code execution outside sandbox.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in Google Chrome on Mac could allow an attacker to execute arbitrary code outside the browser's sandbox when a user visits a malicious HTML page. This could affect the confidentiality, integrity, and availability of the user's system.

User system data and sensitive information.
Malicious HTML page in a browser.
Arbitrary code execution outside sandbox.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects Google Chrome on Mac, and ownership will likely fall to platform or infrastructure teams responsible for managing browser deployments. The first practical step is to identify all Mac systems running the affected browser version, confirm their internet reachability and business criticality, and then determine the accountable owner for remediation.

Browser platform owners should lead remediation.
Verify affected Chrome versions and reachability.
Plan and coordinate browser updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Google Chrome's Tint component?

Tint is a specialized component within the Google Chrome web browser engine responsible for processing and applying color or visual adjustments to interface elements and web content. As part of the rendering pipeline, it handles incoming data to ensure visual consistency across different platforms, including Mac, which serves as the host for this specific browser environment.

How does CVE-2026-87470 work?

This vulnerability is classified as CWE-1284, which involves improper quantity validation. Essentially, the Tint component fails to correctly verify the numerical inputs or resource limits provided by web content. This weakness allows a crafted HTML page to overwhelm the component's internal logic, potentially bypassing the browser's sandbox to execute unauthorized code on the host system.

What triggers this Chrome vulnerability?

The flaw is triggered when a user visits a malicious or specially crafted HTML page using an affected version of Google Chrome on a Mac. It is not triggered by standard, safe web browsing or by internal network services that do not host untrusted web content; the attack requires the browser to actively process the malicious code from an external source.

Who should be concerned about this vulnerability?

According to Halo Surface Signal, this vulnerability is highly relevant because Google Chrome is a client-side application inherently built to render content from the public internet. Because the browser regularly interacts with untrusted external sites, all organizations running affected versions on Mac systems face a significant risk of exposure to malicious web-based threats.

How do I respond to this threat?

Your first step is to perform an inventory of Mac workstations to identify which systems are running browser versions earlier than 153.0.8010.36. Once identified, coordinate with your platform or IT team to prioritize the rollout of the latest browser update, which contains the necessary validation fixes to secure the Tint component and re-establish sandbox protections.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.