EUVD-2026-50762
GHSA-g9jw-mrc3-q55j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker crafts malicious HTML page
-
DeliveryHosts page on attacker-controlled server
-
ExploitVictim tricked into visiting URL in Chrome for iOS
-
ExecutionCrafted page triggers insufficient policy enforcement
-
PersistNavigation restrictions bypassed
-
ImpactAttacker-controlled navigation executed in victim browser
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V4 - API and Web Service Server-side security enforcement
|
| Exploitation Conditions | Exploitation requires that the victim is running Google Chrome on an iOS device at a version prior to 151.0.7922.72 and that the victim visits a specially crafted HTML page - establishing a UI:R (user interaction required) constraint. No authentication, special configuration, or elevated privileges are required on the attacker side (PR:N). The vulnerability is limited to the iOS platform; Chrome on other operating systems is not indicated as affected by this CVE. Exploitation is further limited by the social engineering step needed to direct the victim to the attacker's page. There is no indication of a non-default configuration requirement; any user of an unpatched Chrome for iOS who visits the crafted page is potentially affected. |
| Impact | The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N yields a 6.5 Medium, driven primarily by network accessibility, zero privilege requirement, and High integrity impact - while user interaction is required and there is no confidentiality or availability impact. EPSS at 0.18% (8th percentile) strongly indicates this vulnerability is not being actively exploited at scale, contradicting any urgency implied by the Integrity:High metric. There is no CISA KEV listing and no known public proof-of-concept. The 'Authentication Bypass' tag in the intelligence data likely refers to navigation restriction bypass rather than credential bypass, which is consistent with the description. Real-world risk is constrained by the UI:R requirement - the victim must actively visit a crafted page - and the iOS-platform specificity. This is a real integrity flaw warranting patching, but not an emergency response priority absent KEV listing or POC emergence. |
| Exploit ScenarioDerived | An attacker constructs a malicious HTML page designed to trigger Chrome for iOS's insufficient policy enforcement and hosts it on an attacker-controlled server. A victim on an unpatched iOS device is socially engineered - via phishing email, SMS, or malicious advertisement - into opening the link in Chrome for iOS. Upon rendering the crafted page, the browser's navigation restriction policy is bypassed, potentially allowing the attacker to redirect the victim to unauthorized content, bypass same-origin or popup navigation restrictions, or circumvent security boundaries within the browser. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 31, 2026
Navigation restriction bypass in Google Chrome for iOS prior to 151.0.7922.72 enables remote attackers to circumvent browser-enforced navigation policies by delivering a crafted HTML page to a victim. The flaw originates from insufficient client-side policy enforcement (CWE-602), where the iOS-specific Chrome policy engine fails to prevent unauthorized navigation actions triggered by attacker-controlled content. No public exploit has been identified at time of analysis, and an EPSS score of 0.18% (8th percentile) indicates minimal current exploitation activity; vendor-released patch 151.0.7922.72 is available.
RemediationAI
The primary fix is to update Google Chrome on iOS to version 151.0.7922.72 or later via the Apple App Store; this is the vendor-released patch confirmed by the Chrome Releases blog at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Organizations managing iOS fleets via MDM should push the update through their mobile device management solution. As an interim compensating control prior to patching, users should be instructed not to follow links from untrusted sources in Chrome for iOS; this reduces exposure given the UI:R attack requirement but does not eliminate it. Restricting access to untrusted external web content at the network or DNS filtering layer can further reduce exposure, though this carries usability trade-offs. No workaround eliminates the vulnerability without patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-602 (Client-Side Enforcement of Server-Side Security) describes a class of flaws where security controls are implemented on the client side and can therefore be bypassed by a malicious actor controlling the input. In Chrome for iOS, navigation restriction policies - such as those governing cross-origin navigation, popup blocking, or redirect controls - are enforced at the browser's policy layer. When a specially crafted HTML page is rendered, it can exploit gaps in how Chrome for iOS evaluates or applies these policies, causing the browser to permit navigation actions it should otherwise block. The affected product is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, though the vulnerability is scoped specifically to the iOS platform variant as stated in the CVE description, a distinction the broad CPE string does not capture.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Network-delivered via crafted webpage (AV:N), no privileges needed (PR:N), user must visit page (UI:R), navigation bypass yields high integrity impact with no confidentiality or availability effects.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB