EUVD-2026-116392
GHSA-528r-g499-rgj9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCompromise Chrome renderer process
-
DeliveryDeliver crafted HTML page
-
ExploitTrigger Navigation privilege flaw
-
ExecutionExecute arbitrary code outside sandbox
-
ImpactGain elevated browser-process control
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to have ALREADY compromised the Chrome renderer process (e.g., via a separate renderer bug) and then to have the victim navigate to a crafted HTML page that triggers the Navigation privilege-management flaw to break out of the renderer sandbox. Limiting factors: it is not exploitable standalone (the renderer foothold is a hard prerequisite), it requires user navigation/interaction (UI:R), it is scoped to Chrome on iOS before 157.0.8103.38, and the code execution gained is outside Chrome's renderer sandbox but still within the iOS app sandbox, which constrains further host impact. |
| Impact | Signals point in two directions and must be weighed together. CVSS 8.3 (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) and SSVC 'Technical Impact: total' reflect a full renderer-sandbox escape to arbitrary code execution - serious if reached. However, the description states the attacker must have ALREADY compromised the renderer process, so this is a second-stage bug, not a standalone remote RCE; the nominal PR:N conflicts with that prerequisite, which the vector instead folds into AC:H and UI:R (verify interpretation with the vendor). Counter-signals lower real-world urgency: SSVC Exploitation 'none', no CISA KEV listing, no EPSS score supplied, and no verified public exploit code. Automatable is 'no', meaning it does not lend itself to mass or wormable exploitation. Net: a high-technical-impact defense-in-depth flaw rather than an emergency - consistent with the vendor 'this_week' decision label - that matters mainly as the sandbox-escape link in a chained attack against Chrome on iOS, and should be patched promptly but is not currently evidence of active exploitation. |
| Exploit ScenarioDerived | An attacker who has first exploited a separate renderer vulnerability in Chrome on iOS lures a victim to navigate to a crafted HTML page; the Navigation privilege-management flaw is then abused to run code outside the renderer sandbox. Because the attack requires both a pre-existing renderer compromise and user navigation (AC:H, UI:R), it is realistic as the escape stage of a chained exploit rather than a one-shot drive-by. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
Chrome on iOS before 157.0.8103.38 contains an improper privilege management flaw in the Navigation component that lets an attacker who already holds a compromised renderer process escape the renderer sandbox and execute arbitrary code outside it. The attack path is not standalone: it requires a separate renderer compromise as a precondition plus victim navigation to a crafted HTML page (UI:R), and the resulting code execution remains inside the iOS application sandbox rather than the host. No CISA KEV listing and no public exploit code were reported; vendor patches are available and CISA's SSVC assessment marks exploitation as none with automatable set to no, while technical impact is rated total and Chromium rates the issue High severity.
RemediationAI
Update Chrome for iOS to 157.0.8103.38 or later, the version named in Google's stable channel advisory (https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html); the vendor reports a patch is available. No workaround is described in the available sources, and because the flaw requires a pre-existing renderer compromise, reducing exposure to renderer bugs and keeping the browser current is the practical control. Note that post-exploitation code execution remains confined to the iOS app sandbox, which limits but does not eliminate risk; the referenced Chromium issue (https://issues.chromium.org/issues/568936993) access is typically restricted until users have updated.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified CWE-269 (Improper Privilege Management) and sits in Chrome's Navigation code on iOS, where a component is trusted with privileges it should not hold relative to the renderer. The CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H describes network reachability, a high attack complexity, no privileges required, required user interaction, and a scope change - matching a sandbox-boundary crossing where the vulnerable component and impacted component are different security authorities. The trigger specifics are not described in the available sources beyond the crafted HTML page and the prerequisite compromised renderer; the CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* reflects the broad Chrome product entry, and EUVD pins the affected range to versions earlier than 157.0.8103.38 on iOS.
Know when iOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Prior renderer compromise plus a crafted navigation makes this AC:H/UI:R rather than true PR; sandbox escape crosses a trust boundary (S:C) and yields full code execution (C/I/A:H).
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
2DescriptionCVE.org
Improper privilege management in Navigation in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome on iOS before version 157.0.8103.38 contains a high-severity sandbox escape flaw (CVE-2026-121090). An attacker who has already compromised the browser's renderer process could leverage this to execute arbitrary code within the app sandbox, potentially leading to data theft or further compromise. While no active exploitation is currently observed, the technical impact is total, and mobile users are at risk, making timely patching essential to maintain the integrity of our mobile workforce.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
A use-after-free issue was addressed with improved memory management. Rated high severity (CVSS 7.8), this vulnerability
The DLSw implementation in Cisco IOS does not initialize packet buffers, which allows remote attackers to obtain sensiti
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
Remote code execution in Google Chrome for iOS prior to 156.0.8078.47 is possible when a victim opens a crafted HTML pag
Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mo
Hardcoded TURN relay credentials in the Girafit camera app (Android and iOS) version 1.9.1 and earlier expose a shared,
A vulnerability in the Cisco IOx application hosting environment of multiple Cisco platforms could allow an authenticate
Arbitrary code execution in Jellyfin iOS GitHub Actions workflow. CVSS 10.0.
Memory corruption vulnerabilities in Apple's graphics texture processing engine across iOS, iPadOS, macOS, tvOS, visionO
Buffer overflow memory corruption in Apple file parsing components allows remote code execution across iOS 18.6, iPadOS
A use-after-free issue was addressed with improved memory management. Rated critical severity (CVSS 9.8), this vulnerabi
Exploit-DB