Chrome for iOS CVE-2026-17762

Exploitation requires the victim to be running Google Chrome on an iOS device (iPhone or iPad) at any version prior to 151.0.7922.72 - desktop Chrome and all other iOS browsers including Safari are not affected. User interaction is mandatory: the victim must actively navigate to or load a crafted HTML page, such as via a phishing link or malicious advertisement. The CVSS vector (PR:N) confirms no authentication to any service is required on the attacker's side. The cross-origin data leakage is bounded to what the browser can observe in the affected code path, limiting impact to partial confidentiality loss (C:L). Exploitation is further constrained to iOS-platform deployments of Chrome, significantly narrowing the exposed population compared to vulnerabilities affecting all Chrome platforms. Non-default configurations are not required - any iOS Chrome user below the fix version browsing the web is potentially exposed.

The CVSS 3.1 score of 4.3 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N accurately reflects a moderate but limited threat profile: exploitable over the network with low complexity, no required privileges, but constrained by mandatory user interaction and limited to partial confidentiality loss with no integrity or availability impact. EPSS at 0.21% (11th percentile) is consistent with a platform-scoped, medium-severity information disclosure with no public exploit tooling - exploitation is possible but not a near-term commodity risk. The absence of a KEV listing further supports this as a non-actively-exploited vulnerability. The practical risk ceiling is bounded by the iOS-only scope (desktop Chrome users and non-Chrome iOS browser users are unaffected) and the C:L impact rating, which implies partial rather than wholesale data exfiltration. This is a genuine security flaw warranting prompt patching, but does not represent an emergency priority absent additional threat intelligence.

An attacker crafts a malicious HTML page hosting JavaScript that exploits Chrome for iOS's origin validation flaw and distributes it via phishing email or malicious advertisement. When an iOS user clicks the link and the page loads in an unpatched Chrome browser, the attacker's page reads data from a cross-origin context - for example, content or session artifacts from a site the victim is concurrently authenticated to - and transmits it to an attacker-controlled server. No public POC is available, but the attack requires only a single click from the victim, making social engineering the primary delivery mechanism.