EUVD-2026-105595
GHSA-rj43-g4xh-vh5v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious web page
-
DeliveryServe crafted HTML to Chrome iOS
-
ExploitTrigger memory corruption in iOSWebView
-
ExecutionRead out-of-bounds memory within sandbox
-
ImpactExfiltrate leaked sensitive data
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open a crafted HTML page in Google Chrome for iOS at a version earlier than 156.0.8078.47; the bug is in the iOSWebView component, so only the iOS build of Chrome is affected (desktop and Android Chrome are out of scope here). No authentication is needed (PR:N), but user interaction is required (UI:R) - the target must navigate to or load the attacker-controlled content. The impact is limited to reading memory within the existing renderer sandbox (no sandbox escape, no code execution, no write/integrity or availability impact), which materially bounds real-world risk despite the network attack vector. |
| Impact | This is a genuine but not high-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 6.5) describes a network-reachable, low-complexity, unauthenticated flaw whose only impact is confidentiality - reading memory inside the renderer sandbox - with no integrity or availability impact and no sandbox escape. Google/Chromium rated it only Medium severity, which aligns with the constrained impact. EPSS is low at 0.22% (11th percentile), indicating low modeled probability of near-term exploitation, and there is no CISA KEV listing and no public exploit identified at time of analysis, so this is not confirmed actively exploited. These signals are internally consistent: a medium-severity, info-disclosure-only browser bug requiring user interaction to visit a crafted page, patched by the vendor. No SSVC decision data was provided in the input. One nuance to verify: the description says 'potentially read memory inside the sandbox' (a bounded read primitive), yet the supplied vector assigns C:H - the real-world confidentiality impact may be lower than C:H and closer to a limited leak, so treat C:H as an upper bound rather than confirmed broad data exposure. |
| Exploit ScenarioDerived | A remote attacker hosts or compromises a web page containing crafted HTML that triggers the iOSWebView memory-corruption flaw when a victim opens it in Google Chrome for iOS. Because the vector requires user interaction (UI:R) and yields only an in-sandbox memory read, the attacker's realistic goal is to leak sensitive memory contents (e.g., to defeat ASLR or harvest in-process secrets) rather than achieve code execution. No public proof-of-concept exploit was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Memory corruption in the iOSWebView component of Google Chrome for iOS (versions prior to 156.0.8078.47) allows a remote attacker who convinces a victim to load a crafted HTML page to read memory inside the renderer sandbox. Only the iOS build is affected - desktop and Android Chrome are out of scope - and the assessed impact is confidentiality-only (C:H/I:N/A:N) with no sandbox escape or code execution. No public exploit code or active exploitation is identified at time of analysis, and EPSS is low at 0.22% (11th percentile), though the vendor has released a patched build.
RemediationAI
Vendor-released patch: upgrade Google Chrome for iOS to 156.0.8078.47 or later via the App Store, and verify the installed version under Chrome settings; the fixed build is documented in the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html (Chromium issue 523705767). Because exploitation requires the victim to load a crafted HTML page and yields only in-sandbox memory reads, residual risk while patching is modest: organizations can reduce exposure by restricting managed iOS devices to allowlisted browsing destinations or disabling Chrome for iOS in favor of the platform browser where policy allows - at the cost of reduced user flexibility - and by treating renderer memory exposure as a credential/token leakage risk, rotating any sensitive tokens that may have transited unpatched devices. There is no configuration toggle that disables the affected iOSWebView component itself, so patching remains the only complete fix; no vendor workaround is identified in the available data.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-119 improper restriction of operations within the bounds of a memory buffer (memory corruption, tagged as a buffer overflow) resident in Chrome for iOS's iOSWebView layer - the WebKit/WKWebView-based embedding that Chrome uses on iOS rather than its own Blink renderer, which is why the issue is platform-specific to iOS. Out-of-bounds memory access of this class can lead to out-of-bounds reads; per the assessed vector the consequence here is disclosure of memory contents within the sandbox (C:H, I:N, A:N) rather than corruption leading to code execution, and the Chromium team rates it Medium severity. Exploitation is network-reachable (AV:N) with low complexity and no privileges required (PR:N), but depends on user interaction (UI:R) to load attacker-controlled HTML, and the sandbox confinement limits blast radius: a successful attacker gains read access to renderer memory, which could expose in-process secrets such as URLs, tokens, or other page-derived data, but cannot by itself break out of the sandbox or modify state.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Network-reachable crafted page with no auth (AV:N/PR:N) but requiring the victim to open it (UI:R); impact is confined in-sandbox memory disclosure, so S:U, C:H, I:N, A:N.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Memory corruption in iOSWebView in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Exploit-DB