What is the CVSS score of CVE-2026-9971?

CVE-2026-9971 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-9971?

Yes, a patch is available for CVE-2026-9971. Update the affected software to the latest version immediately.

Google Chrome iOS CVE-2026-9971

EUVD-2026-33113 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-28 Chrome

GHSA-3g4q-5xwc-2fr8

XSS Google Apple

5.4

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

SUSE

MEDIUM

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 18:29 vuln.today

CVSS changed

May 29, 2026 - 18:22 NVD

5.4 (MEDIUM)

CVE Published

May 28, 2026 - 22:25 nvd

MEDIUM 5.4

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in iOS in Google Chrome on iOS prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engage in specific UI gestures to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Universal Cross-Site Scripting (UXSS) in Google Chrome on iOS prior to 148.0.7778.216 enables a remote unauthenticated attacker to inject arbitrary scripts or HTML into the browser context by convincing a target user to perform specific UI gestures on a crafted HTML page. The vulnerability stems from an inappropriate implementation in Chrome's iOS-specific code layer (CWE-79), and while UXSS attacks typically carry cross-origin escalation potential, the CVSS S:U (Unchanged scope) rating suggests cross-origin impact is not confirmed by the scoring authority. No public exploit or active exploitation has been identified at time of analysis; EPSS at 0.06% places this in the 17th percentile of exploitation likelihood.

Technical ContextAI

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting), specifically manifesting as an 'inappropriate implementation' in the iOS platform layer of Google Chrome. UXSS attacks exploit browser-level flaws rather than application-level flaws, meaning attacker-controlled script may execute across security contexts beyond the originating page. Chrome on iOS uses Apple's WKWebView rendering engine rather than Blink/V8 as on other platforms, and iOS-specific code paths governing gesture handling, navigation, or content injection are the probable attack surface based on the description. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering all Chrome versions prior to 148.0.7778.216 on iOS, though the CPE string itself does not restrict to the iOS platform - iOS specificity is confirmed only via the vulnerability description.

RemediationAI

The primary fix is updating Google Chrome on iOS to version 148.0.7778.216 or later, available via the Apple App Store. The patch is confirmed vendor-released per the Chrome stable channel update blog at chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. For organizations managing iOS fleets via MDM, enforce the minimum Chrome version policy to 148.0.7778.216 immediately. As a compensating control prior to patching, administrators can restrict access to untrusted or external web content by enforcing URL allowlists through Chrome enterprise policy on managed iOS devices, though this may limit general browsing functionality. User awareness around performing UI gestures prompted by untrusted web pages provides marginal risk reduction given the social engineering prerequisite.