EUVD-2026-105547
GHSA-j5cm-g55g-xq7v
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Impact | Signals are moderate-to-strong on paper but real-world urgency is tempered. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates a remote, unauthenticated, low-complexity attack with high impact to confidentiality, integrity, and availability, but it explicitly requires user interaction (UI:R) and does NOT change scope (S:U), meaning code execution is confined to the renderer sandbox. This aligns with the description ('execute arbitrary code inside the sandbox') and with the vendor's own 'Chromium security severity: Medium' rating - notably LOWER than the 8.8 CVSS, suggesting the sandbox containment materially limits practical impact without a chained sandbox escape. EPSS exploitation probability is NOT provided, there is no CISA KEV listing, and no POC is referenced, so there is no public exploit identified at time of analysis. SSVC inputs (exploitation status, automatability) were not supplied. Net assessment: this is a patch-promptly browser flaw rather than an emergency - the headline 8.8 overstates urgency because the impact is sandbox-contained and no exploitation or exploit code is evidenced. Verify: CVSS indicates full C/I/A:H, but 'inside the sandbox' plus the vendor 'Medium' rating implies constrained impact absent a chained escape. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Google Chrome for iOS before 156.0.8078.47 fails to properly validate input in its Mobile component, allowing a remote, unauthenticated attacker who convinces a user to open a crafted HTML page to achieve arbitrary code execution inside the browser's sandbox. Successful exploitation requires user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) and is confined to the sandbox boundary, so it does not by itself imply full device compromise; Google rates the underlying issue as Chromium security severity Medium, a notable gap from the 8.8 base score. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and our independent assessment holds that the paper signals are moderate-to-strong while real-world urgency remains tempered.
RemediationAI
Upgrade Google Chrome for iOS to version 156.0.8078.47 or later through the Apple App Store - this is the vendor-released patch and the only complete fix, since the vulnerable validation logic lives in the app binary and cannot be corrected by configuration on affected builds. For managed fleets, push the 156.0.8078.47 update via MDM/volume-purchase or App Store enforcement and verify the reported version string post-update; because iOS apps update out of band from OS patching, track Chrome separately from iOS version compliance. Where immediate upgrade is impossible, compensating controls are limited because exploitation is triggered by ordinary page rendering: restrict high-risk browsing through managed allow-lists or a proxy that blocks uncategorized and newly registered domains (trade-off: heavy false positives and degraded usability), and rely on user-interaction gating - exploitation requires the victim to open a crafted page, so phishing-resistant link handling and per-site isolation practices reduce exposure but do not eliminate it. Disabling JavaScript is not a viable mitigation for a general user base and may not block the vector at all. Consultant advisory reference: https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html; note that no public exploit code was identified at time of analysis, so emergency out-of-band response is not indicated, but standard patch-window SLAs should apply.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-20 (Improper Input Validation) in the mobile-specific code paths of Chrome on iOS, meaning attacker-controlled data from HTML content reaches logic that assumes a trusted, well-formed shape and is not correctly bounds-, type-, or state-checked before use. Chrome on iOS is architecturally constrained to Apple's WebKit/WKWebView rendering engine rather than Chromium's Blink, so the affected surface sits in the Chrome-for-iOS layer that bridges web content to native mobile functionality; a validation gap there lets a crafted page corrupt or redirect that flow and obtain code execution within the renderer sandbox rather than escaping it. The CVSS vector indicates no privileges are required (PR:N) but that the victim must load the malicious page (UI:R), and the scope is unchanged (S:U), consistent with impact staying inside the sandbox. The medium vendor severity versus the 8.8 base score reflects the difference between theoretical sandbox-internal code execution and the absence of a demonstrated sandbox escape or chain.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (google) · only source for this CVE.
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Improper input validation in Mobile in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome for iOS versions before 156.0.8078.47 have a high-severity flaw that can let an attacker execute code inside the browser sandbox when a user visits a malicious page. The impact is contained within the browser sandbox and depends on user interaction, so full-device compromise is not implied, but affected mobile users remain exposed until they update. No public exploit identified at time of analysis; leadership should prioritize fleet remediation over incident response.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB