What is the CVSS score of CVE-2026-9955?

CVE-2026-9955 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-9955?

Yes, a patch is available for CVE-2026-9955. Update the affected software to the latest version immediately.

Google Chrome iOS CVE-2026-9955

EUVD-2026-33097 MEDIUM

Information Exposure (CWE-200)

2026-05-28 Chrome

GHSA-m82j-qrh3-2j8q

Apple Information Disclosure Google Red Hat Chrome

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

SUSE

MEDIUM

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 18:29 vuln.today

CVSS changed

May 29, 2026 - 18:22 NVD

4.3 (MEDIUM)

CVE Published

May 28, 2026 - 22:25 nvd

MEDIUM 4.3

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in iOS in Google Chrome on iOS prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Cross-origin data leakage in Google Chrome on iOS prior to 148.0.7778.216 exposes sensitive information from cross-origin resources to remote attackers via a crafted HTML page. The flaw is confined to Chrome's iOS-specific implementation (distinct from Chrome on Android, Windows, or macOS), meaning the affected population is limited to iOS users running unpatched Chrome builds. With a CVSS score of 4.3 (Medium), no CISA KEV listing, and an EPSS of 0.03% (11th percentile), no public exploit identified at time of analysis, this is a real but lower-priority disclosure issue - though the zero-privilege-required network vector merits timely patching.

Technical ContextAI

The vulnerability is rooted in CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and exists within the iOS-specific code layer of Google Chrome. On iOS, Chrome is required by Apple's App Store policy to use the WebKit rendering engine rather than its native Blink/V8 stack, meaning Chrome on iOS has a distinct implementation path for web APIs and cross-origin enforcement. The 'inappropriate implementation' designation (the same classification Google uses for logic bugs in browser subsystems) suggests that Chrome's iOS wrapper incorrectly handles or bypasses Same-Origin Policy (SOP) enforcement in some specific scenario, allowing a page to read data from a cross-origin context it should not have access to. The affected CPE cpe:2.3:a:google:chrome is broad, but description and EUVD affected-versions data narrow scope to Chrome on iOS versions prior to 148.0.7778.216.

RemediationAI

Upgrade Google Chrome on iOS to version 148.0.7778.216 or later - this is the vendor-released patch confirmed via the Chrome Releases blog (http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html). Updates can be applied through the iOS App Store by navigating to the Updates tab and installing the latest Chrome release, or via Chrome's built-in update prompt. No documented workarounds specific to this vulnerability have been published. For organizations unable to immediately patch, a compensating control would be to enforce a Mobile Device Management (MDM) policy restricting Chrome on iOS to approved, known-safe origins, or to require users to use Safari (which uses WebKit natively without Chrome's iOS wrapper code) for sensitive browsing sessions - though this does not constitute a fix and should be treated as a temporary measure only.