Chrome for iOS CVE-2026-17960

The victim must be using Google Chrome on an iOS device running a version prior to 151.0.7922.72. User interaction is required: the victim must navigate to (or be redirected to) an attacker-controlled crafted HTML page - this is not a drive-by exploit triggered by passive exposure. Exploitation is limited to the specific iOS code path; Chrome on other platforms is not affected. The attacker gains value only if the victim is navigating from a page whose URL carries sensitive information (e.g., session tokens in the URL, internal hostnames, or private resource paths) that the site operator intended to suppress via Referrer-Policy: no-referrer. Sites that do not rely on referrer suppression for privacy or security are not meaningfully impacted. No authentication or special account privileges are required from the attacker side.

Multiple independent signals converge on low real-world priority. The CVSS 3.1 base score of 4.3 (Medium-low boundary) reflects network reachability but is bounded by required user interaction (UI:R), no privilege escalation, and limited impact scope (S:U). EPSS at 0.18% (8th percentile) is well below the exploitation threshold where defenders typically intervene urgently. SSVC corroborates this: Exploitation status is 'none', the attack is not automatable (Automatable: no, consistent with UI:R), and Technical Impact is only partial. No CISA KEV listing and no public POC have been identified. The Tags field includes 'Authentication Bypass,' but this appears to be a tagging artefact - the CVSS PR:N metric simply reflects that no attacker account is needed, not that authentication systems are bypassed. The actual security boundary violated is the browser-enforced referrer suppression policy. This is a real but low-priority hygiene issue rather than an emergency patch.

An attacker hosts a crafted HTML page designed to trigger the no-referrer policy bypass and embed a resource request to an attacker-controlled server. When a victim navigating from a sensitive origin (e.g., an internal application or authenticated portal) clicks a link to the crafted page in Chrome for iOS, the browser incorrectly includes the Referer header in the outbound request, leaking the origin URL to the attacker's server logs. No public POC code has been identified, and the attack requires social engineering to deliver the crafted page to a victim.