EUVD-2026-93695
GHSA-fvjf-wv38-6x3c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger missing authorization in navigation
-
ExecutionBypass web origin policy
-
ImpactAccess privileged browser page
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a victim running Google Chrome on iOS prior to version 155.0.8059.39 who actively opens or navigates to a crafted HTML page controlled by the attacker (CVSS UI:R). No authentication is required (PR:N, unauthenticated). The principal limiting factors are the mandatory user interaction (the attack cannot succeed without the victim loading the malicious page) and the narrow platform scope - only the iOS build of Chrome is affected, not Chrome on other operating systems - which bounds the exposed population despite the network attack vector. |
| Impact | This is a moderate-priority issue rather than an urgent one. The CVSS 3.1 base score of 7.6 (vector AV:N/AC:L/PR:N/UI:R) describes a network-reachable, low-complexity, unauthenticated flaw, but the UI:R component means exploitation hinges on tricking a victim into opening attacker-controlled content, which materially lowers real-world likelihood. Multiple low-risk signals converge: EPSS is only 0.22% (12th percentile), the flaw is not listed in CISA KEV, no public exploit code was identified, and Google/Chromium rated the security severity merely 'Medium' - notably lower than the 7.6 numeric score, a common divergence because Chromium severity weighs exploit practicality and sandbox context, not just raw CVSS. No SSVC decision data (exploitation/automatable/technical-impact) was supplied, so that framework cannot be applied. The one elevating factor is ubiquity of the affected product. Net: a credible same-day-patch item for fleets running Chrome on iOS, but not evidence of a widely weaponized threat; treat as routine browser-update hygiene unless KEV/EPSS status changes. |
| Exploit ScenarioDerived | An attacker publishes or links to a crafted HTML page and lures a user of Chrome on iOS (pre-155.0.8059.39) into opening it. A missing-authorization flaw in navigation lets the page bypass the web origin policy and reach a privileged browser page, exposing data or functionality that should be isolated from web content. No public exploit code was identified at the time of analysis, and success depends on the victim actually navigating to the malicious page (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Web origin policy bypass in Google Chrome's Navigation component on iOS allows a remote, unauthenticated attacker to escape intended origin boundaries and reach a privileged page when a victim opens a crafted HTML page. Exploitation is constrained by two factors: the mandatory user interaction (CVSS UI:R - the victim must actively load the malicious page) and the narrow platform scope, since only the iOS build of Chrome is affected rather than Chrome on other operating systems. Risk signals are modest - EPSS is 0.22% (12th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis - and Google has shipped a fix, so this is a moderate-priority issue rather than an urgent one.
RemediationAI
Vendor-released patch: upgrade Google Chrome for iOS to 155.0.8059.39 or later via the Apple App Store, which is the only supported distribution channel for Chrome on iOS; verify the installed version in Chrome's in-app version display and confirm the update has been applied before treating the device as remediated. Because Chrome on iOS cannot be reliably updated without user action on managed devices, force the update through MDM app-update policies or require a minimum version in mobile device compliance rules - the trade-off is that devices below the floor must be blocked from corporate resources until updated. There is no documented configuration toggle in the supplied data that disables the Navigation authorization path, so blocking crafted navigation is impractical; compensating measures worth considering are limiting high-risk browsing through managed wrappers or a proxy that blocks untrusted HTML, and restricting exposed privileged surfaces (for example, disabling saved credentials or sign-in on the affected profile) to reduce the value of a successful origin bypass. Note these workarounds degrade usability and do not fully close the issue, so patching remains the primary action; hardening guidance and the authoritative fix announcement are available at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html and the tracking issue at https://issues.chromium.org/issues/504215649.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified as CWE-862 (Missing Authorization) and lives in Chrome's Navigation subsystem on iOS. Navigation handling decides which document a frame is permitted to display and what privileges that document inherits; when authorization checks on a navigation target are absent, a page from an untrusted origin can be loaded into a context reserved for privileged, browser-internal content, effectively defeating the web origin policy (the same-origin boundary that isolates web content from browser UI and privileged resources). The attack vector is network-based and requires no credentials (CVSS:3.1/AV:N/AC:L/PR:N/UI:R, with only integrity and availability impacts rated low against a high confidentiality impact), consistent with an attacker enticing a user to a page they control. CPE data (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) combined with the vendor's own versioning confirms the exposure is limited to Chrome on iOS builds prior to 155.0.8059.39; Chrome on desktop and Android are not implicated by this record. Google rated the underlying Chromium security severity as Medium. The affected technology stack is Blink/WebKit-derived iOS navigation and origin enforcement rather than a remote memory-corruption primitive.
Know when iOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L
Remotely reachable crafted page with no privileges (PR:N) but mandatory victim navigation (UI:R); origin-policy bypass into a privileged page gives high confidentiality exposure with limited integrity/availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Missing authorization in Navigation in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome for iOS contains a high-severity security flaw that could let a crafted webpage bypass browser origin protections and reach privileged content. The exposure is limited to users browsing with Chrome on iPhones and iPads, and exploitation requires the user to open a malicious page; there is no public exploit identified at time of analysis and a vendor fix is available. Leadership should treat this as a moderate, manageable mobile-browsing risk and prioritize patching affected devices.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
A use-after-free issue was addressed with improved memory management. Rated high severity (CVSS 7.8), this vulnerability
The DLSw implementation in Cisco IOS does not initialize packet buffers, which allows remote attackers to obtain sensiti
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
AirKeyboard iOS App 1.0.5 contains a missing authentication vulnerability that allows unauthenticated attackers to type
Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mo
A vulnerability in the Cisco IOx application hosting environment of multiple Cisco platforms could allow an authenticate
Arbitrary code execution in Jellyfin iOS GitHub Actions workflow. CVSS 10.0.
Memory corruption vulnerabilities in Apple's graphics texture processing engine across iOS, iPadOS, macOS, tvOS, visionO
Buffer overflow memory corruption in Apple file parsing components allows remote code execution across iOS 18.6, iPadOS
A use-after-free issue was addressed with improved memory management. Rated critical severity (CVSS 9.8), this vulnerabi
Cisco IOS 15.5(3)M on Integrated Services Router (ISR) 800, 819, and 829 devices allows remote attackers to cause a deni
Exploit-DB