Google Chrome iOS CVE-2026-11272

Victim must be running Google Chrome on iOS at a version below 149.0.7827.53 and must visit attacker-controlled HTML content in that browser. The user must then perform specific UI gestures that the attacker has designed the page to elicit - interaction with the Reading List feature is the exploitation surface, so the gesture sequence likely involves invoking save-to-reading-list or related context-menu actions on attacker-controlled content. Limiting factors: exploitation is bounded to the iOS platform only (desktop/Android Chrome not affected per the description), requires user interaction (CVSS UI:R), and depends on the victim completing a precise gesture sequence rather than passive page load, which is why Google rated Chromium severity as Low despite CVSS 8.8.

Signals here are notably divergent and warrant careful weighting. CVSS 3.1 of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) suggests a high-impact remote unauthenticated flaw, but EPSS sits at just 0.05% (15th percentile) and Google itself assigned Chromium severity 'Low' - a strong vendor-internal signal that practical exploitability is limited. The CVSS UI:R requirement combined with the description's emphasis on 'specific UI gestures' indicates exploitation depends on a precise, non-trivial user action sequence that is hard to socially engineer at scale. The CVE is not on CISA KEV, no public exploit identified at time of analysis, and the vulnerability is platform-restricted to iOS Chrome, further narrowing the attack surface. Realistic prioritization: routine patching cycle rather than emergency; the high CVSS is misleading without considering the gesture-dependent exploitation path that Google's 'Low' rating reflects.

An attacker hosts a crafted HTML page and lures an iOS Chrome user via phishing link, malicious ad, or compromised site; once the page loads, the user is socially engineered into performing a specific gesture (e.g., long-press to invoke a context menu, then tapping a Reading List action) which triggers the input-validation flaw and elevates the attacker's web context to a higher-privilege Chrome action. No public exploit identified at time of analysis, and the requirement for a precise, attacker-guided gesture sequence makes mass-scale exploitation impractical, though targeted attacks against specific users remain feasible.