EUVD-2026-50575
GHSA-h26p-54rh-wmmw
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-delivered via webpage (AV:N), but AC:H for the required social-engineered UI gesture sequence; only low confidentiality leakage with no integrity or availability impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Cross-origin data leakage in Google Chrome for iOS (versions prior to 151.0.7922.72) allows remote attackers to read cross-origin data by delivering a crafted HTML page that socially engineers the victim into performing specific UI gestures. The root cause is an inappropriate implementation classified under CWE-346 (Origin Validation Error), meaning Chrome's iOS-specific code fails to correctly enforce same-origin policy boundaries under particular interaction sequences. No active exploitation has been confirmed - CISA KEV status is absent, SSVC exploitation rating is 'none', and EPSS sits at 0.21% (11th percentile) - placing this firmly in the low-priority tier despite its network delivery vector.
Technical ContextAI
CWE-346 (Origin Validation Error) indicates the browser fails to properly verify origin boundaries in a specific code path within Chrome's iOS implementation. Chrome on iOS uses a distinct rendering and UI-handling layer compared to the desktop variant, as Apple's App Store policies historically required third-party browsers to use WebKit as the underlying engine - creating a unique attack surface in Chrome's own abstraction layer above WebKit. The inappropriate implementation allows a cross-origin read to be triggered when the user performs specific UI gestures on a crafted page, effectively bypassing the same-origin policy protections that should prevent one origin from reading another's data. The affected CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Chrome versions below the fix threshold on the iOS platform.
RemediationAI
The primary fix is upgrading Google Chrome on iOS to version 151.0.7922.72 or later, available through the Apple App Store. The patch is confirmed available per the vendor's stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html and the Chromium issue tracker at https://issues.chromium.org/issues/517690521. For organizations unable to enforce immediate updates, a compensating control is to raise user awareness around suspicious pages that prompt unusual tap or swipe sequences, as exploitation depends entirely on social engineering the victim into specific UI gestures - removing that interaction breaks the attack chain. Mobile device management (MDM) policies can also be used to enforce minimum Chrome version requirements on managed iOS devices. No meaningful network-layer mitigation exists since the attack originates from a user-visited webpage over standard HTTPS.
Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today