EUVD-2026-34665
GHSA-7c8v-9ggw-48f4
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Signin in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Navigation restriction bypass in Google Chrome for iOS (versions prior to 149.0.7827.53) exploits an inappropriate implementation within the Signin component, enabling a remote attacker to circumvent navigation controls by delivering a crafted HTML page to a victim. Per CVSS (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N), no authentication is required by the attacker, but user interaction is necessary - the victim must visit or load the malicious page. No public exploit has been identified at time of analysis, SSVC reports exploitation as none, and the EPSS score of 0.02% (4th percentile) indicates very low likelihood of opportunistic exploitation; nevertheless, the high integrity impact warrants prompt patching on all managed iOS Chrome deployments.
Technical ContextAI
The vulnerability is rooted in CWE-284 (Improper Access Control) and specifically affects the Signin feature implementation in Google Chrome on iOS. On iOS, Chrome enforces navigation restrictions as part of its security model - particularly within authenticated or sign-in flows - to prevent unauthorized cross-origin navigation or boundary violations that could expose user session state or redirect users outside expected security contexts. The 'inappropriate implementation' classification (Chromium severity: Medium) indicates that the access control logic governing which navigations are permitted during or around the Signin flow was incorrectly coded, allowing a crafted HTML page to subvert those controls. This is distinct from a memory safety bug; it is a logic-level access control failure specific to the iOS platform build of Chrome, not the desktop or Android variants. The affected CPE range covers all Chrome iOS builds prior to 149.0.7827.53.
RemediationAI
The primary fix is to update Google Chrome on iOS to version 149.0.7827.53 or later, which contains the corrected Signin navigation restriction implementation. This update is available via the Apple App Store; enterprise MDM administrators should push the update through managed iOS device channels. The advisory is available at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. If immediate update is not possible, a specific compensating control is to restrict or disable access to the Signin flow within Chrome on unmanaged or high-risk iOS devices by enforcing browser policy via MDM to prevent sign-in (this disables the vulnerable code path but also disables Chrome sync and account features - a meaningful trade-off for productivity). There is no indication of a server-side workaround since the flaw is client-side in the iOS Chrome binary.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today