EUVD-2026-93598
GHSA-7mq7-gq4g-8f52
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitPage triggers Selection authorization flaw
-
ExecutionRead unauthorized sensitive data
-
ImpactExfiltrate information to attacker
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to actively open an attacker-controlled crafted HTML page in Google Chrome for iOS at a version below 155.0.8059.39 (UI:R). It is remote and unauthenticated (PR:N) against default configurations - no special Chrome setting or feature toggle is named in the description - but it is bounded by three real limiting factors: mandatory user interaction (visiting the malicious page), the narrow affected population (only the iOS build of Chrome, not desktop or Android), and the already-available vendor fix. Impact is limited to disclosure of sensitive information via the Selection component's incorrect authorization; no code execution or data modification is described. |
| Impact | Signals conflict sharply and must be reconciled before prioritization. The input CVSS base score of 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) rates this High/Critical, but the description states only that a remote attacker can 'obtain sensitive information,' and Google/Chromium explicitly rates the Chromium security severity as Low. The claimed I:H and A:H impacts are not supported by the description, which describes an information-disclosure (confidentiality-only) issue via CWE-863 incorrect authorization in the Selection component - the 8.8 score appears inflated relative to the actual impact. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no evidence of active or imminent exploitation. Net assessment: this is a high-CVSS-but-low-real-risk item. It requires user interaction (UI:R, victim must open a crafted HTML page), affects only Chrome on iOS below 155.0.8059.39, and is already patched by the vendor. Treat as routine browser-update hygiene rather than an emergency; the Low Chromium rating and absence of exploitation signals outweigh the nominal 8.8. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page and lures an iOS Chrome user (pre-155.0.8059.39) to open it, e.g. via a phishing link or malicious ad. The page abuses the incorrect-authorization flaw in the Selection implementation to read sensitive content the page should not be permitted to access, leaking it to the attacker. No public exploit code was identified at the time of analysis, and the attack requires the victim to actively visit the page (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Incorrect authorization in the Selection component of Google Chrome for iOS lets a remote, unauthenticated attacker obtain sensitive information when a victim opens a crafted HTML page, and the issue is resolved in Chrome 155.0.8059.39. Only the iOS build of Chrome below that version is in scope; desktop and Android builds are not named as affected, and exploitation requires the user to actively visit the attacker-controlled page (UI:R per the assessed vector). No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so the practical risk is bounded by mandatory user interaction, the narrow iOS-only affected population, and the fact that a vendor fix already ships; note that the supplied base score of 8.8 (C:H/I:H/A:H) is inconsistent with both the Chromium 'Low' severity label and the assessed vector, which rates impact as confidentiality-only.
RemediationAI
Vendor-released patch: 155.0.8059.39 - upgrade Google Chrome for iOS to that version or later via the App Store, using the stable channel announcement at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html as the authoritative reference, and track the underlying fix at https://issues.chromium.org/issues/503708636. Because the patch already exists and the affected population is limited to iOS builds below that version, the highest-value action is simply enforcing auto-update or pushing the version through MDM/enterprise app management on managed iOS devices, which may force an app restart but has no functional side effects. If immediate updating is not possible, compensating controls are limited and come with trade-offs: temporarily directing iOS users to a different browser for untrusted browsing reduces exposure to this Selection-component path but shifts usage away from the organization's managed browser and does not address the underlying defect; restricting users from following untrusted links or opening HTML attachments is only a partial control because the trigger is an ordinary crafted web page; and blocking known-bad domains provides minimal protection given that the page can be hosted anywhere. Note that disabling JavaScript or site features in Chrome for iOS is not a reliable workaround because the flaw is in the browser's authorization logic for the Selection component rather than in page script, and there is no published configuration toggle that removes the exposure. No public exploit code has been identified at time of analysis, so emergency out-of-band mitigation beyond the standard update cycle is not warranted, but the update should still be tracked to completion on iOS endpoints.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an authorization-check defect (CWE-863) in Chrome's Selection component, the subsystem that manages text selection ranges, caret positioning, and the interfaces by which page content and browser UI exchange selected data. When an authorization decision in that path is made incorrectly, a page can reach data it should not be entitled to read, which manifests as sensitive information disclosure rather than memory corruption or code execution. The affected CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) is unversioned and platform-agnostic, so it cannot by itself confirm scope; the description and EUVD entry constrain the issue to Chrome on iOS before 155.0.8059.39. Chrome on iOS is architecturally distinct from the desktop and Android builds because it renders through the platform WebKit-based engine while the Chromium-inherited selection and UI layer sits on top, which is consistent with a single-platform impact. The assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N describes a network-reachable, unauthenticated trigger gated entirely by user interaction, with confidentiality-only impact and no integrity or availability loss - a materially different picture from the 8.8 / C:H/I:H/A:H base score supplied alongside the CVE, which would imply total loss of confidentiality, integrity, and availability.
Know when iOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Low–High)AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no auth (AV:N/AC:L/PR:N) but requires victim navigation (UI:R); description and Chromium Low rating indicate limited confidentiality-only disclosure, so C:L and I:N/A:N.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Incorrect authorization in Selection in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
Executive ViewAI
Google Chrome for iOS versions prior to 155.0.8059.39 contain an incorrect authorization vulnerability that could allow a remote attacker to obtain sensitive information when a user visits a crafted web page. Although the CVSS score is 8.8, the practical risk is bounded by the required user interaction, the narrow iOS-only affected population, and the fact that no public exploit identified at time of analysis and the issue is not actively exploited; a vendor fix already ships. Leadership should prioritize patching iOS Chrome deployments to protect mobile users' data, though the actual business impact is moderate given these constraints and the availability of the patch.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
A use-after-free issue was addressed with improved memory management. Rated high severity (CVSS 7.8), this vulnerability
The DLSw implementation in Cisco IOS does not initialize packet buffers, which allows remote attackers to obtain sensiti
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
AirKeyboard iOS App 1.0.5 contains a missing authentication vulnerability that allows unauthenticated attackers to type
Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mo
A vulnerability in the Cisco IOx application hosting environment of multiple Cisco platforms could allow an authenticate
Arbitrary code execution in Jellyfin iOS GitHub Actions workflow. CVSS 10.0.
Memory corruption vulnerabilities in Apple's graphics texture processing engine across iOS, iPadOS, macOS, tvOS, visionO
Buffer overflow memory corruption in Apple file parsing components allows remote code execution across iOS 18.6, iPadOS
A use-after-free issue was addressed with improved memory management. Rated critical severity (CVSS 9.8), this vulnerabi
Cisco IOS 15.5(3)M on Integrated Services Router (ISR) 800, 819, and 829 devices allows remote attackers to cause a deni
Exploit-DB