EUVD-2026-79987
GHSA-5m53-p6pr-frc2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure iOS Chrome user via social engineering
-
DeliveryDeliver crafted network traffic
-
ExploitTrigger PriceTracking confused deputy
-
ExecutionBypass access restriction into privileged page
-
ImpactLimited data read/modify (C:L/I:L)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service Proxy/intermediary controls
|
| Exploitation Conditions | Requires the victim to be running Google Chrome on iOS at a version below 153.0.8010.47 AND to be socially engineered into an action that triggers the PriceTracking feature, while the attacker supplies crafted network traffic. Limiting factors: high attack complexity (AC:H), the explicit social-engineering/user-interaction requirement, and the confined impact (a privileged in-browser page, not device or OS compromise). Impact is limited to Low confidentiality and Low integrity within the browser context; there is no availability impact and no code execution outside Chrome. |
| Impact | This is a genuinely low-priority issue despite the 'Authentication Bypass' tag. The vendor CVSS of 4.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) reflects a Medium Chromium severity confused-deputy flaw (CWE-441) in the PriceTracking feature of Chrome on iOS, with only Low confidentiality and Low integrity impact and no availability effect. Every exploitation signal points to low real-world risk: EPSS is 0.22% (12th percentile), there is no CISA KEV listing, and no public exploit code has been identified. High attack complexity (AC:H) plus reliance on social engineering further reduce practicality. One internal inconsistency to verify: the vendor vector encodes UI:N, yet the description explicitly states exploitation requires 'leveraging social engineering,' which normally implies user interaction (UI:R) - this tension slightly understates the human-in-the-loop requirement rather than the raw severity. No public exploit; treat as routine patch-cycle remediation, not an emergency. |
| Exploit ScenarioDerived | A remote attacker crafts malicious network traffic and uses social engineering to lure a Chrome-for-iOS user into triggering the PriceTracking confused-deputy flaw, causing the browser to treat attacker-influenced input as if it originated from a privileged/trusted page and thereby bypassing an access restriction. Because AC:H and social engineering are both required, exploitation is opportunistic and unreliable, and no public proof-of-concept exists. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 18, 2026
Confused-deputy handling in the PriceTracking component of Google Chrome on iOS lets a remote, unauthenticated attacker reach a privileged in-browser page and bypass system access restrictions on versions prior to 153.0.8010.47. Exploitation is not straightforward - it requires the attacker to pair crafted network traffic with successful social engineering of the user (the independent assessment scores AC:H and UI:R, even though the published NVD vector lists UI:N), and the resulting impact is confined to Low confidentiality and Low integrity inside the browser context with no availability loss and no code execution outside Chrome. There is no evidence of active exploitation (no CISA KEV listing) and no public exploit code identified at time of analysis; EPSS is only 0.22% (12th percentile), and a vendor fix is already available, making this a genuinely low-priority issue despite the 'Authentication Bypass' tag.
RemediationAI
The primary fix is to update Google Chrome on iOS to version 153.0.8010.47 or later through the App Store, which is the vendor-released patched version documented in the Chrome Releases stable-channel advisory (https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0541751186.html); enable automatic App Store updates so the corrected build is applied without user action. If immediate updating is not possible, compensating controls should target the social-engineering precondition because the flaw cannot be triggered by crafted traffic alone: users and managed fleets should be instructed or configured not to follow unsolicited links or prompts that invoke Chrome's price-tracking/shopping features on iOS, and where a Chrome policy or in-app setting is available, disable shopping/price-tracking features to remove the deputy from the attack path - the trade-off is loss of price-comparison functionality. Organisations can also use iOS MDM to force the minimum Chrome version and to restrict browsing to managed profiles, which reduces exposure without patching but does not fully eliminate the confused-deputy path. Because impact is confined to Low confidentiality and Low integrity within the browser and there is no KEV listing, no public exploit, and a low EPSS of 0.22%, aggressive network-level blocking is not warranted; remediation should be prioritised behind any actively exploited issues, and reference should be kept to Chromium issue 513858387 for engineering detail.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-441 (Confused Deputy): a component that holds higher privilege than its caller performs an action on the caller's behalf without adequately validating the origin or authority of the request, so an unprivileged context can borrow the privileged component's rights. Here the deputy is Chrome on iOS's PriceTracking functionality, part of Chrome's shopping/commerce surface, which runs with privileges that ordinary web content does not have and can be induced to act against a privileged page. The published CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/S:U/C:L/I:L/A:N) confirms a network-reachable, unauthenticated attack path, but the authoritative independent assessment adjusts the vector to UI:R, reflecting the description's explicit social-engineering precondition - the victim must be induced to trigger the PriceTracking interaction while the attacker controls the network traffic. Note the discrepancy: the raw NVD vector says UI:N, while the independent assessment treats user interaction as required; the independent UI:R reading is the one used here and is consistent with the vendor description. The CWE and access-control framing are consistent with the 'Authentication Bypass' and 'Apple' tags (iOS-only Chrome build) and with the Chromium security severity of Medium; no CPE strings were supplied in the source data, and the only mapped advisory identifiers are EUVD-2026-79987 and Chromium issue 513858387.
Know when Chrome gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Network-reachable and unauthenticated, but the description's social-engineering requirement justifies UI:R and AC:H; impact is limited to L/L within the browser.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Confused deputy in PriceTracking in Google Chrome on on iOS prior to 153.0.8010.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions into a privileged page via crafted network traffic. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Vendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB