EUVD-2026-33092
GHSA-q69j-7xqc-6c6x
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
Insufficient validation of untrusted input in iOS in Google Chrome on iOS prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Same-origin policy bypass in Google Chrome for iOS (all versions prior to 148.0.7778.216) allows an attacker who has already achieved renderer process compromise to cross browser origin boundaries via a crafted HTML page, potentially exposing restricted cross-origin content. The root cause is insufficient validation of untrusted input (CWE-20) in iOS-specific Chrome code, a platform-divergent codepath not present in desktop Chrome. No public exploit has been identified and no CISA KEV listing exists; however, Chromium's internal 'High' severity rating contrasts with the NVD CVSS score of 3.1, reflecting that the renderer pre-compromise prerequisite substantially constrains standalone exploitability while the SOP bypass itself carries serious chaining potential.
Technical ContextAI
The vulnerability affects Google Chrome running on iOS, identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, with all versions below 148.0.7778.216 confirmed vulnerable per EUVD data. CWE-20 (Improper Input Validation) identifies the root cause class: Chrome's iOS-specific code path fails to adequately validate untrusted input when processing HTML content, allowing the same-origin policy (SOP) enforcement mechanism to be circumvented. SOP is a foundational browser security boundary preventing scripts executing in one origin from reading data belonging to a different origin; bypassing it can expose authentication tokens, session cookies, or sensitive page content across origins. On iOS, Chrome operates under constraints imposed by Apple's platform, and the iOS-specific input handling layer appears to diverge from the validation logic present in desktop Chrome builds, creating a platform-isolated attack surface. The vulnerability is tagged as an Authentication Bypass, reflecting that SOP functions as an access-control boundary whose circumvention is functionally equivalent to an authorization bypass in the browser security model.
RemediationAI
Vendor-released patch: 148.0.7778.216. Update Google Chrome for iOS to version 148.0.7778.216 or later via the Apple App Store; this is the primary and recommended remediation as confirmed by the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. As a compensating control prior to patching, organizations managing iOS fleets via MDM (e.g., Jamf, Microsoft Intune) can enforce content filtering policies or restrict navigation to untrusted external domains in Chrome, though this reduces browsing functionality and does not address the underlying flaw. Because exploitation requires a prior renderer compromise, ensuring that Chrome's built-in sandbox is not disabled via enterprise policy and that iOS system-level security features (e.g., Lockdown Mode for high-risk users) are enabled reduces the likelihood of the prerequisite renderer compromise being achieved, thereby indirectly mitigating this chained risk.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today