Chrome for iOS CVE-2026-11277

Exploitation requires that the victim be using Google Chrome on an iOS device running a version prior to 149.0.7827.53, and that the victim navigate to or be redirected to an attacker-controlled crafted HTML page - user interaction (UI:R) is mandatory per the CVSS vector. The CVSS vector PR:N confirms no authentication is required from the attacker's side. Impact is limited to integrity (I:L) with no confidentiality or availability consequences (C:N/A:N), and scope is unchanged (S:U), meaning exploitation does not break out of the browser security boundary into the underlying OS. The vulnerability is exclusive to the iOS platform variant of Chrome; users on Chrome for desktop (Windows, macOS, Linux) or Chrome for Android are not affected by this specific issue based on available data.

The CVSS base score of 4.3 (Medium) is consistent with a network-reachable, low-complexity attack requiring user interaction and producing only partial integrity impact (I:L) with no confidentiality (C:N) or availability (A:N) effect. The EPSS score of 0.02% at the 4th percentile reinforces that automated or widespread exploitation is highly unlikely. This vulnerability is not listed in the CISA KEV catalog, and no public exploit code has been identified at time of analysis. Chromium's own severity rating of 'Low' aligns with the CVSS and EPSS signals. The combination of required user interaction (UI:R), absence of confidentiality impact, and iOS-platform-only scope substantially limits real-world attacker utility - this is not a high-priority emergency but should be remediated in the normal patching cycle. No conflicting signals between data sources were observed.

An attacker hosts a crafted HTML page designed to trigger Chrome for iOS's insufficient policy enforcement, then lures a target user - via phishing link, malicious advertisement, or compromised site redirect - into visiting the page on an unpatched iOS device. Upon rendering the page, Chrome's discretionary access control check is bypassed, permitting the attacker to perform an unauthorized write or integrity-affecting action within the browser's context. No public exploit code has been identified at time of analysis, keeping this scenario largely theoretical.