EUVD-2026-34675
GHSA-gmhx-jjqv-69v4
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Cross-origin data leakage in Google Chrome for iOS prior to version 149.0.7827.53 enables a remote unauthenticated attacker to read sensitive data from cross-origin resources by tricking a user into visiting a crafted HTML page. The flaw stems from an inappropriate implementation in the iOS-specific Chrome code path (CWE-346: Origin Validation Error), undermining the browser's Same-Origin Policy enforcement on Apple's platform. No public exploit code exists and no active exploitation is confirmed; with an EPSS of 0.03% (11th percentile), real-world risk is currently assessed as low despite the high confidentiality impact in the CVSS scoring.
Technical ContextAI
Google Chrome on iOS is constrained by Apple's App Store policies to use WebKit's WKWebView rendering engine rather than Chrome's own Blink engine used on other platforms. This architectural split creates a distinct implementation layer where Chrome's security features - including cross-origin isolation and Same-Origin Policy enforcement - must be implemented on top of WKWebView rather than natively. CWE-346 (Origin Validation Error) indicates the root cause is a failure to properly verify that data or communication originates from a legitimate, same-origin source. The vulnerability manifests in HTML page parsing or resource loading logic specific to the iOS build, allowing crafted markup to bypass origin checks and read data scoped to other origins. The affected CPE scope covers all Chrome for iOS releases prior to 149.0.7827.53, as confirmed by the EUVD affected version range 'Chrome 149.0.7827.53 <149.0.7827.53'.
RemediationAI
The primary fix is to update Google Chrome for iOS to version 149.0.7827.53 or later, available through the Apple App Store. The vendor has confirmed patch availability via the Chrome Stable Channel Update advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. For organizations that cannot immediately deploy the update, a compensating control is to restrict access to sensitive internal web applications from iOS Chrome browsers until the patch is applied - for example, by enforcing browser version checks at the application layer or through MDM policy. Note that blocking iOS Chrome at the network perimeter may degrade user experience and is not a permanent solution. No configuration-level workaround within Chrome for iOS itself has been identified to mitigate this specific flaw.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today