EUVD-2026-50622
GHSA-h989-9wh8-qq8f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost crafted HTML page remotely
-
DeliveryDeliver link to iOS Chrome user via phishing
-
ExploitVictim opens page in Chrome for iOS
-
ExecutionInsufficient policy enforcement triggered
-
PersistDiscretionary access control bypass achieved
-
ImpactUnauthorized integrity modification occurs
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The victim must be running Google Chrome (not Safari or another browser) on an iOS device with Chrome prior to version 151.0.7922.72. User interaction is required: the victim must actively navigate to or click a link pointing to the attacker-controlled crafted HTML page. The CVSS vector PR:N confirms no authentication to any service is required from the attacker's side. Exploitation is limited to the iOS platform specifically; desktop Chrome and Android Chrome are not in scope for this CVE. The attack does not require any non-default configuration - any default installation of a vulnerable Chrome for iOS version is susceptible once the user visits the malicious page. Confidentiality and availability are not impacted; impact is confined to integrity (access control bypass). |
| Impact | CVSS 6.5 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N reflects a network-reachable, low-complexity attack requiring one click from the victim, with high integrity impact but no confidentiality or availability loss. EPSS at 0.19% (9th percentile) indicates that exploitation in the wild is very unlikely based on historical patterns for similar CVEs - this is a low-priority signal. The vulnerability is not listed in the CISA KEV catalog and no public proof-of-concept has been identified at time of analysis. The UI:R requirement meaningfully limits opportunistic exploitation - an attacker must social-engineer the victim to visit a malicious page. The integrity-only impact (C:N/A:N) further constrains real-world damage compared to full-compromise vulnerabilities. Overall: this is a genuine but medium-priority issue; patch on normal cadence unless iOS users are high-value targets in your threat model, in which case expedite. |
| Exploit ScenarioDerived | An attacker registers a domain and serves a crafted HTML page designed to trigger Chrome for iOS's insufficient policy enforcement code path. The attacker sends a phishing link via email, SMS, or social media to a target iOS user. When the user opens the link in Chrome for iOS, the page bypasses discretionary access control, potentially enabling unauthorized writes or modifications to protected resources within the browser's sandbox. No public exploit code is known, so this scenario currently requires custom exploit development. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 31, 2026
Discretionary access control bypass in Google Chrome for iOS prior to 151.0.7922.72 allows a remote attacker to violate iOS access control boundaries by enticing a user to visit a specially crafted HTML page. The flaw stems from insufficient policy enforcement unique to the iOS version of Chrome, meaning desktop Chrome is not affected by this specific variant. No public exploit code has been identified and EPSS signals low exploitation probability, but the integrity-only CVSS impact and user-interaction requirement make this a realistic phishing-assisted attack path.
RemediationAI
Update Google Chrome on iOS to version 151.0.7922.72 or later via the Apple App Store. This is the vendor-released patch confirmed by the Chrome Releases blog at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Automatic updates should apply this fix on most iOS devices when connected to Wi-Fi; manually trigger the update in the App Store if auto-updates are disabled. If immediate patching is not possible, consider restricting access to untrusted web content through Mobile Device Management (MDM) URL filtering policies, though this reduces browser functionality. No workaround is documented by the vendor that preserves full browser functionality while mitigating the flaw.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-284 (Improper Access Control) classifies this as a failure to correctly enforce access policies rather than a memory-safety issue. Chrome for iOS is architecturally distinct from desktop Chrome: Apple's App Store policies require third-party browsers on iOS to use the WebKit rendering engine, so Chrome for iOS wraps WebKit with its own policy and permission layers. The vulnerability lies in those Chrome-specific iOS policy enforcement layers - a crafted HTML page can trigger a code path that bypasses discretionary access control (DAC) checks that would otherwise restrict resource or capability access. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Chrome versions; the iOS scope is narrowed by the CVE description and advisory context rather than the CPE itself.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Network-delivered via crafted HTML with no privileges required; user must visit the page (UI:R); impact is integrity-only DAC bypass with no confidentiality or availability loss.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB