What is the CVSS score of CVE-2026-10944?

CVE-2026-10944 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-10944?

Yes, a patch is available for CVE-2026-10944. Update the affected software to the latest version immediately.

Google Chrome iOS CVE-2026-10944

EUVD-2026-34393 MEDIUM

Protection Mechanism Failure (CWE-693)

2026-06-04 chrome-cve-admin@google.com

GHSA-3jg9-qm9h-3qvh

Information Disclosure Google Apple

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

SUSE

MEDIUM

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 20:30 vuln.today

CVSS changed

Jun 05, 2026 - 20:22 NVD

6.5 (MEDIUM)

CVSS changed

Jun 05, 2026 - 20:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:16 nvd

MEDIUM 6.5

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient policy enforcement in Autofill in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Cross-origin data exfiltration via Autofill in Google Chrome on iOS (prior to 149.0.7827.53) allows a remote attacker to leak sensitive data across origin boundaries by directing a victim to a crafted HTML page. The flaw stems from insufficient policy enforcement in the Autofill subsystem - a protection mechanism failure (CWE-693) that bypasses same-origin boundary controls exclusive to the iOS platform build of Chrome. No public exploit code has been identified at time of analysis, and the EPSS score of 0.03% (11th percentile) indicates very low observed exploitation probability. A vendor-released patch is available.

Technical ContextAI

The vulnerability resides in Google Chrome's Autofill subsystem specifically on iOS, governed by CWE-693 (Protection Mechanism Failure). Autofill implementations interact closely with browser security boundaries - including the same-origin policy - to prevent one origin from reading form data or autofill suggestions populated in the context of another. On iOS, Chrome's Autofill policy enforcement failed to adequately isolate cross-origin contexts, meaning a crafted HTML page could trigger autofill behavior that exposes data belonging to a different origin. This is distinct from desktop Chrome behavior, implicating iOS-specific code paths in Chromium's iOS port. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) confirms the vulnerability is network-reachable, low complexity, requires no privileges, but does require user interaction - consistent with a browser-based lure attack pattern.

RemediationAI

Update Google Chrome on iOS to version 149.0.7827.53 or later, which contains the vendor-released patch for this vulnerability. The patch is documented in Google's stable channel update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Users should update through the Apple App Store. If immediate update is not possible, a compensating control is to disable Chrome's Autofill feature on iOS (Settings > Google Chrome > Autofill and Passwords, disable autofill options); note this reduces usability by requiring manual form entry. Alternatively, avoiding untrusted or unsolicited web pages until the update is applied reduces exposure, since exploitation requires user navigation to a crafted HTML page.