EUVD-2026-50661
GHSA-6h54-mhpr-h92g
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Network-delivered open redirect with mandatory user click (UI:R), no auth needed (PR:N), integrity-only impact from navigation bypass; no C or A impact applies.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Navigation restriction bypass in Google Chrome for iOS (prior to 151.0.7922.72) enables a remote attacker to redirect users to unintended URLs via a crafted HTML page, exploiting a CWE-601 open redirect condition. The Chromium team rated this Low severity, consistent with the CVSS 4.3 score and the limited integrity-only impact (no confidentiality or availability consequences). No public exploit identified at time of analysis, and the EPSS score of 0.18% (8th percentile) reflects minimal exploitation interest from the threat actor community.
Technical ContextAI
The root cause is CWE-601 (URL Redirection to Untrusted Site / Open Redirect), classified by Chromium as 'Inappropriate Implementation' in Chrome's iOS navigation layer. Unlike desktop Chrome, Chrome for iOS is built on Apple's WebKit rendering engine due to App Store policy restrictions, meaning its navigation handling differs significantly from Blink-based platforms. This architectural constraint may explain why a navigation restriction bypass exists on iOS but not on other Chrome platforms. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers Google Chrome broadly, but the vulnerability description explicitly scopes impact to the iOS platform only. A crafted HTML page can exploit the flawed navigation implementation to redirect the browser to an attacker-controlled destination, bypassing expected URL restriction controls.
RemediationAI
Update Google Chrome for iOS to version 151.0.7922.72 or later via the Apple App Store, which contains the vendor-released patch per the Chrome Releases advisory at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Organizations managing iOS fleets should enforce this update through MDM policies (e.g., Jamf, Microsoft Intune) using App Store enforcement controls to ensure rapid rollout. As a compensating control prior to patching, end-user security awareness guidance to avoid clicking unsolicited links on iOS Chrome is advisable, though this is a behavioral rather than technical control and carries no enforcement guarantee. There are no known workarounds that disable the underlying navigation feature without removing browser functionality.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Vendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today