Chrome for iOS CVE-2026-11298

Exploitation requires that the victim is using Google Chrome (not Safari or other browsers) on an iOS device running a Chrome version below 149.0.7827.53. User interaction is mandatory (UI:R per CVSS) - the victim must open the attacker-crafted HTML page; drive-by exploitation without any user action is not possible. Attack complexity is low (AC:L), meaning no race condition or special configuration is required once the page is loaded. The vulnerability is not present in Chrome desktop builds or non-iOS mobile builds based on available data. There is no privilege requirement on the attacker's side (PR:N), meaning the attacker needs only a publicly reachable page. Factors limiting exploitation: iOS-platform specificity, mandatory user click-through, and a low integrity-only impact ceiling make this significantly less dangerous than a full cross-origin read or RCE.

Multiple signals converge on a low real-world risk rating. CVSS base score is 4.3 (Medium), but the UI:R requirement means passive exploitation against unaware users is constrained - victims must actively open a crafted page. EPSS sits at 0.02% (4th percentile), indicating the broader threat-intel community sees near-zero near-term exploitation probability. SSVC rates exploitation as 'none' and automatable as 'no', reinforcing that mass exploitation is not feasible. The technical impact is 'partial' (I:L), limited to integrity - no data exfiltration (C:N) or denial of service (A:N). Chromium's own severity rating is 'Low'. There is no CISA KEV listing and no public POC at time of analysis. This is a legitimate security flaw warranting a patch on the standard update cycle, but does not justify emergency change windows or compensating controls in the interim for most organizations.

An attacker hosts a crafted HTML page designed to trigger Chrome for iOS's flawed origin validation logic. The attacker then socially engineers a target iOS user - via phishing email, malicious link in a message, or a compromised advertisement - to open the page in Chrome on their iPhone or iPad. Upon page load, Chrome incorrectly permits a script from one origin to perform limited write operations against a resource belonging to a different origin, potentially altering page content or state in ways that could facilitate further attacks such as UI redirection. No public POC exists at time of analysis.