Chrome for iOS CVE-2026-106323

Requires the victim to be running Google Chrome for iOS at a version prior to 155.0.8059.39 and to be socially engineered into loading an attacker-crafted HTML page - user interaction (UI:R) is mandatory, so exploitation cannot occur without the victim opening or navigating to the malicious content. No authentication is required (PR:N, unauthenticated remote attacker), and no special non-default browser configuration is called out in the description. The primary limiting factors are the required user interaction and the narrow affected population (only iOS Chrome builds below the fixed version); the exact triggering feature or authorization boundary is not specified beyond 'missing authorization' leading to out-of-sandbox code execution.

Signals point to a genuine high-priority browser flaw, though not an emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, base 9.6) describes network-reachable, unauthenticated, low-complexity exploitation with a scope change (S:C) consistent with the description's 'execute arbitrary code outside the sandbox' - the C:H/I:H/A:H and S:C combination is internally coherent for a sandbox escape. The key mitigating signal is UI:R: exploitation is not automatic and requires the victim to be socially engineered into loading a crafted HTML page. On threat-activity signals the data is thin: there is no EPSS score, no CISA KEV listing, and no indication of public POC in the input, so this is 'no public exploit identified at time of analysis' rather than an actively exploited bug. The CWE-862 (Missing Authorization) classification sits somewhat awkwardly against a described outcome of out-of-sandbox code execution - the 'Authentication Bypass' tag and CWE suggest an authorization/permission-boundary failure that is leveraged into RCE, but the precise mechanism is not detailed. Net: a vendor-patched, high-severity client-side vulnerability worth prompt patching given Chrome's footprint, but the UI:R requirement and absence of KEV/EPSS/POC data argue against treating it as wormable or under mass exploitation. Note a reference inconsistency (desktop release-notes URL for an iOS-specific CVE) that should be verified against the Chromium issue tracker entry.

An attacker lures a Chrome-for-iOS user (via phishing link, malicious ad, or compromised site) to a crafted HTML page. When the victim loads the page, the missing-authorization flaw is triggered to break out of the browser sandbox and run attacker-controlled code on the device. No public exploit code is identified in the available data, and success depends on the victim interacting with the malicious page (UI:R).