EUVD-2026-34665
GHSA-7c8v-9ggw-48f4
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Signin in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Navigation restriction bypass in Google Chrome for iOS (versions prior to 149.0.7827.53) exploits an inappropriate implementation within the Signin component, enabling a remote attacker to circumvent navigation controls by delivering a crafted HTML page to a victim. Per CVSS (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N), no authentication is required by the attacker, but user interaction is necessary - the victim must visit or load the malicious page. No public exploit has been identified at time of analysis, SSVC reports exploitation as none, and the EPSS score of 0.02% (4th percentile) indicates very low likelihood of opportunistic exploitation; nevertheless, the high integrity impact warrants prompt patching on all managed iOS Chrome deployments.
Technical ContextAI
The vulnerability is rooted in CWE-284 (Improper Access Control) and specifically affects the Signin feature implementation in Google Chrome on iOS. On iOS, Chrome enforces navigation restrictions as part of its security model - particularly within authenticated or sign-in flows - to prevent unauthorized cross-origin navigation or boundary violations that could expose user session state or redirect users outside expected security contexts. The 'inappropriate implementation' classification (Chromium severity: Medium) indicates that the access control logic governing which navigations are permitted during or around the Signin flow was incorrectly coded, allowing a crafted HTML page to subvert those controls. This is distinct from a memory safety bug; it is a logic-level access control failure specific to the iOS platform build of Chrome, not the desktop or Android variants. The affected CPE range covers all Chrome iOS builds prior to 149.0.7827.53.
RemediationAI
The primary fix is to update Google Chrome on iOS to version 149.0.7827.53 or later, which contains the corrected Signin navigation restriction implementation. This update is available via the Apple App Store; enterprise MDM administrators should push the update through managed iOS device channels. The advisory is available at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. If immediate update is not possible, a specific compensating control is to restrict or disable access to the Signin flow within Chrome on unmanaged or high-risk iOS devices by enforcing browser policy via MDM to prevent sign-in (this disables the vulnerable code path but also disables Chrome sync and account features - a meaningful trade-off for productivity). There is no indication of a server-side workaround since the flaw is client-side in the iOS Chrome binary.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today