EUVD-2026-93602
GHSA-qwwj-rf4m-2ppv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger confused deputy in Chrome iOS
-
ExecutionBypass restrictions to privileged page
-
ImpactPartial read/modify of protected context
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service Proxy/intermediary controls
|
| Exploitation Conditions | Exploitation requires a victim running Google Chrome for iOS prior to 155.0.8059.39 to load attacker-controlled crafted HTML content (UI:R - user interaction is the primary limiting factor). No authentication is required (PR:N) and the attack is network-delivered (AV:N) with low complexity (AC:L). Exploitation is constrained to the iOS/mobile Chrome build specifically, not desktop Chrome, and the described confused-deputy condition must be reachable in a default configuration (no special toggle is named in the advisory). Impact is bounded: partial confidentiality and integrity against a 'privileged page,' no availability impact, and no scope change beyond the browser context. |
| Impact | Signals align consistently toward LOW real-world priority. CVSS 3.1 is 5.4 (medium) with AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - network-reachable and unauthenticated, but requiring user interaction (loading a crafted page) and yielding only partial, unchanged-scope confidentiality and integrity impact with no availability impact. EPSS is 0.18% (7th percentile), i.e. very low predicted exploitation probability. SSVC reinforces this: Exploitation=none (no observed or public exploit), Automatable=no, Technical Impact=partial - a 'Track' rather than 'Act' posture. The vulnerability is NOT in CISA KEV and no POC is referenced, so this is 'no public exploit identified at time of analysis.' Google itself rated the Chromium severity 'Low.' No conflicting signals were found: the CVSS vector, EPSS, SSVC, and vendor severity all point the same direction. The main caveat is simply that this affects an extremely widely used browser, so even a low-severity issue warrants routine patching, but there is no evidence this is an urgent or actively exploited threat. |
| Exploit ScenarioDerived | An attacker hosts or injects a crafted HTML page and lures an iOS Chrome user (pre-155.0.8059.39) into opening it, e.g. via a malicious link or a compromised/ad-served page. The confused-deputy flaw causes the mobile browser to treat the attacker's content as authorized to reach a privileged internal page, bypassing access restrictions to partially read or manipulate otherwise protected context. No public exploit code is identified at time of analysis, and user interaction is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Google Chrome for iOS builds prior to 155.0.8059.39 contain a confused-deputy weakness that lets a remote, unauthenticated attacker bypass system access restrictions and reach a privileged browser page when a victim loads a crafted HTML page (CVSS 5.4, PR:N/UI:R). Exploitation is bounded by the required user interaction - the victim must open the attacker-supplied content - and impact is limited to partial confidentiality and integrity with no availability effect, while EPSS is only 0.18 percent (7th percentile) and there is no public exploit identified at time of analysis, matching CISA SSVC output of Exploitation: none and Technical Impact: partial. Desktop Chrome is not implicated by the advisory; only the iOS/mobile build is affected, and the real-world priority assessed is LOW.
RemediationAI
Vendor-released patch: upgrade Google Chrome for iOS to 155.0.8059.39 or later, which is the first release at or above the fixed threshold named in the advisory; on consumer devices this arrives through App Store auto-updates, and administrators of managed iOS fleets should push the update via MDM rather than relying on user-initiated updates, then confirm the installed build string after restarting the app. Because the vendor states a patch is available and no non-upgrade permanent fix is documented, compensating controls are temporary and carry trade-offs: enforcing an MDM policy that blocks or delays Chrome on iOS until it reports 155.0.8059.39 removes the exposure window at the cost of disrupting users who rely on Chrome's cross-device sync and sign-in features; restricting the browser to allowlisted internal origins (or mandating an alternative, unpatched-but-unaffected browser) reduces the chance a victim loads attacker-controlled HTML but degrades general web usability; and since the vector requires UI:R, user guidance to avoid opening unsolicited links is only a marginal safety net, not a control. Verification details and the full list of fixes in this release are in the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html, with the underlying engineering discussion at https://issues.chromium.org/issues/513423334.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-441 (Confused Deputy): the browser is a program holding privileges that exceed those of the content it renders, and it performed a privileged operation on behalf of attacker-influenced input without validating that the request legitimately carried that authority. On iOS, Google Chrome is constrained to Apple's WebKit-based rendering engine (WKWebView) rather than Chromium's Blink, and this issue sits at the seam between that web content and a privileged page inside the browser or the iOS system access boundary it guards - the advisory describes the outcome as bypassing system access restrictions to reach a privileged page. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N confirms network delivery, low attack complexity, and no authentication prerequisite, with the required victim interaction (UI:R) being the dominant limiting factor; scope is unchanged (S:U) and there is no availability impact. The supplied CPE, cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, is a generic Google Chrome pattern that is not platform-scoped, so the authoritative scope restriction comes from the description and EUVD data, which pin the issue to Chrome on iOS below 155.0.8059.39. Chromium security severity for this issue is Low, and the associated EUVD entry is EUVD-2026-93602.
Know when iOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Network-delivered crafted page with no auth (AV:N/PR:N) but requiring the victim to open it (UI:R); confused deputy grants only partial read/modify of a privileged page (C:L/I:L/A:N), scope unchanged.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Confused deputy in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Low)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
A use-after-free issue was addressed with improved memory management. Rated high severity (CVSS 7.8), this vulnerability
The DLSw implementation in Cisco IOS does not initialize packet buffers, which allows remote attackers to obtain sensiti
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
Remote code execution in Google Chrome for iOS prior to 156.0.8078.47 is possible when a victim opens a crafted HTML pag
Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mo
Hardcoded TURN relay credentials in the Girafit camera app (Android and iOS) version 1.9.1 and earlier expose a shared,
A vulnerability in the Cisco IOx application hosting environment of multiple Cisco platforms could allow an authenticate
Arbitrary code execution in Jellyfin iOS GitHub Actions workflow. CVSS 10.0.
Memory corruption vulnerabilities in Apple's graphics texture processing engine across iOS, iPadOS, macOS, tvOS, visionO
Buffer overflow memory corruption in Apple file parsing components allows remote code execution across iOS 18.6, iPadOS
A use-after-free issue was addressed with improved memory management. Rated critical severity (CVSS 9.8), this vulnerabi
Exploit-DB