Google Chrome iOS CVE-2026-14074

Exploitation requires that the victim actively navigates to and loads the attacker-controlled HTML page using Google Chrome on iOS (UI:R per CVSS), which necessitates a phishing or social engineering delivery step. The vulnerability is strictly iOS-specific - Chrome on Android, Windows, macOS, or Linux is not in scope. The side-channel nature of CWE-1300 means the attacker must be able to collect and process timing measurements with sufficient precision; browser-level timer mitigations (SharedArrayBuffer restrictions, reduced timer resolution) deployed post-Spectre may limit or degrade exploitation reliability in practice. Authentication to the attacker's page is not required (PR:N), but no server-side special configuration is needed on the victim's end either. Exploitation is limited by: required victim interaction, iOS-only platform scope, and side-channel noise sensitivity.

The provided CVSS 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) is in tension with Chromium's own Low internal severity rating - the NVD C:H reflects the theoretical worst-case cross-origin data exposure, while Chromium's assessment likely accounts for the practical difficulty of reliably exploiting a side-channel under real-world noise and browser timer mitigations deployed post-Spectre. EPSS at 0.21% (11th percentile) strongly supports the low-priority view. There is no KEV listing and no known POC. The iOS-specific scope further limits the blast radius compared to a cross-platform Chrome flaw. The discrepancy between C:H in the CVSS vector and Chromium's Low severity is notable - defenders should weight Chromium's classification alongside CVSS rather than treating CVSS in isolation. Real-world priority is low unless the deployment context involves highly sensitive WebAuthn-protected resources on iOS.

An attacker crafts a malicious HTML page that programmatically invokes the WebAuthentication API and measures observable side-channel differences - such as response timing - in the Chrome iOS WebAuthn implementation. When a victim visits this page using Chrome on iOS, the attacker's script collects enough timing or state samples to infer cross-origin data about a target origin's authentication context. No public exploit code is identified at time of analysis, and the reliability of such an attack would be degraded by existing browser timer precision reductions.