EUVD-2026-50738
GHSA-7wx4-25xq-m4j2
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Network delivery with mandatory user interaction; Integrity:High reflects navigation bypass with no confidentiality or availability loss; PR:N as no attacker credentials are required.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via malicious network traffic. (Chromium security severity: Medium)
AnalysisAI
Navigation restriction bypass in Google Chrome for iOS prior to 151.0.7922.72 allows remote attackers to circumvent browser navigation controls by delivering maliciously crafted network traffic to a victim device. The flaw stems from insufficient input validation (CWE-20) in the iOS-specific implementation of Chrome, resulting in an Integrity:High impact - enabling unauthorized navigation, redirect manipulation, or security-boundary evasion - with no confidentiality or availability consequences. No public exploit has been identified and EPSS places exploitation probability at just 0.17% (7th percentile), indicating low active exploitation risk at time of analysis.
Technical ContextAI
The vulnerability resides in Google Chrome's iOS-specific codebase, where Chrome operates under Apple's platform constraints - including WKWebView for rendering - rather than the standard Chromium desktop stack. CWE-20 (Improper Input Validation) identifies the root cause as failure to properly sanitize or validate untrusted data arriving via network traffic before it is processed by the browser's navigation subsystem. Navigation restrictions in browsers enforce same-origin policy, cross-origin redirect controls, and content security boundaries; insufficient validation of attacker-controlled input can cause these controls to be bypassed. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers the Chrome product family broadly, with the iOS-platform specificity confirmed by the CVE description. The Chromium issue tracker entry at issues.chromium.org/issues/513855922 may contain additional technical root-cause detail not available in the provided intelligence.
RemediationAI
Update Google Chrome on iOS to version 151.0.7922.72 or later - this is the vendor-released patch as confirmed by the Chrome Releases advisory at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. The update is available through the Apple App Store and can be applied via automatic app updates or manually by searching for Google Chrome and selecting 'Update'. If immediate patching is not possible, reduce exposure by avoiding untrusted or public Wi-Fi networks without VPN protection, as the attack requires delivery of malicious network traffic; a VPN eliminates the network-adjacent attack surface. Restricting iOS device network access to trusted infrastructure also limits exploitation opportunity. Note that these compensating controls do not address the underlying validation flaw and should not substitute for patching.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today