EUVD-2026-40634
GHSA-7xj3-67hv-x5fp
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Changed scope to S:C because the flaw breaches cross-origin isolation boundaries, reading data from a security domain distinct from the attacker's origin.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in ScriptInjections in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Cross-origin data leakage in Google Chrome on iOS (prior to 150.0.7871.47) stems from an inappropriate implementation in the ScriptInjections subsystem, exploitable by a remote attacker who can lure a victim to a crafted HTML page. The flaw allows the attacker's origin to read data belonging to a different, protected origin - a fundamental violation of the Same-Origin Policy on Apple's iOS platform. No public exploit code has been identified at time of analysis, EPSS places exploitation probability at 0.22% (13th percentile), and SSVC signals no observed active exploitation, making this a medium-priority patch item despite its cross-origin impact.
Technical ContextAI
The ScriptInjections component in Chrome on iOS is responsible for injecting scripts into web page contexts, including cross-origin frames or navigation targets. An 'inappropriate implementation' here - catalogued under CWE-352 (Cross-Site Request Forgery) by NVD - points to a flaw where origin isolation boundaries are improperly enforced during script injection, enabling one origin to trigger or read the result of operations scoped to another origin. The iOS-specific nature of this bug likely stems from how WKWebView (Apple's iOS browser engine framework, which Chrome must use on iOS due to platform restrictions) handles script injection APIs differently from Blink on desktop platforms. CPE data from EUVD confirms the affected software as Chrome versions below 150.0.7871.47 running on iOS. The mismatch between the CWE-352 (CSRF) classification and the described impact (cross-origin data leak) is notable - the actual vulnerability more closely resembles CWE-346 (Origin Validation Error) or CWE-200 (Information Exposure Through an Environmental Control). The CSRF tag may reflect that the underlying trigger mechanism uses a cross-site request pattern, but the primary consequence is data disclosure, not state-changing forgery.
RemediationAI
Update Google Chrome on iOS to version 150.0.7871.47 or later, available through the Apple App Store. The vendor-released patch is documented in the Chrome stable channel update advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. If immediate patching is not feasible, the practical interim control is to restrict user access to untrusted or unknown web pages on devices running Chrome for iOS, particularly in environments where authenticated sessions with sensitive cross-origin data are active. No configuration flag or feature disable is documented to mitigate the ScriptInjections flaw without updating. Switching to Safari on iOS as a temporary measure eliminates the vulnerable code path entirely, since Safari uses the same WKWebView substrate but does not contain Chrome's ScriptInjections layer; note this may break enterprise workflows dependent on Chrome-specific behavior.
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today