EUVD-2026-66081
GHSA-h7p7-qfhv-ghrr
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Description specifies local attacker via local program (AV:L); no elevated privileges required for the co-resident app; confidentiality-only impact with no integrity or availability loss.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
Information leak in Mobile in Google Chrome on on iOS prior to 152.0.7977.65 allowed a local attacker to potentially obtain sensitive information via a local program. (Chromium security severity: Low)
AnalysisAI
Information disclosure in Google Chrome's Mobile component on iOS exposes sensitive data to local attackers operating via a local program, affecting all Chrome for iOS versions prior to 152.0.7977.65. The vulnerability is classified CWE-200 (Exposure of Sensitive Information) and carries a Chromium internal severity of Low, which aligns with SSVC's assessment of partial technical impact and non-automatable exploitation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to have a program executing locally on the target iOS device, meaning a malicious application must already be installed and running on the same device as the vulnerable Chrome for iOS instance. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Conflicting signals require explicit attention. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An adversary distributes a malicious iOS application - potentially through side-loading or a compromised enterprise distribution profile - that, once installed alongside Chrome for iOS on the victim's device, runs a local program to read sensitive information inadvertently exposed by Chrome's Mobile subsystem. The attacker gains access to the leaked data (browsing artifacts, credentials, or session tokens, depending on what Chrome fails to protect) without any network interaction. … |
| Remediation | Vendor-released patch: Chrome for iOS 152.0.7977.65. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today