EUVD-2026-34675
GHSA-gmhx-jjqv-69v4
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Cross-origin data leakage in Google Chrome for iOS prior to version 149.0.7827.53 enables a remote unauthenticated attacker to read sensitive data from cross-origin resources by tricking a user into visiting a crafted HTML page. The flaw stems from an inappropriate implementation in the iOS-specific Chrome code path (CWE-346: Origin Validation Error), undermining the browser's Same-Origin Policy enforcement on Apple's platform. No public exploit code exists and no active exploitation is confirmed; with an EPSS of 0.03% (11th percentile), real-world risk is currently assessed as low despite the high confidentiality impact in the CVSS scoring.
Technical ContextAI
Google Chrome on iOS is constrained by Apple's App Store policies to use WebKit's WKWebView rendering engine rather than Chrome's own Blink engine used on other platforms. This architectural split creates a distinct implementation layer where Chrome's security features - including cross-origin isolation and Same-Origin Policy enforcement - must be implemented on top of WKWebView rather than natively. CWE-346 (Origin Validation Error) indicates the root cause is a failure to properly verify that data or communication originates from a legitimate, same-origin source. The vulnerability manifests in HTML page parsing or resource loading logic specific to the iOS build, allowing crafted markup to bypass origin checks and read data scoped to other origins. The affected CPE scope covers all Chrome for iOS releases prior to 149.0.7827.53, as confirmed by the EUVD affected version range 'Chrome 149.0.7827.53 <149.0.7827.53'.
RemediationAI
The primary fix is to update Google Chrome for iOS to version 149.0.7827.53 or later, available through the Apple App Store. The vendor has confirmed patch availability via the Chrome Stable Channel Update advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. For organizations that cannot immediately deploy the update, a compensating control is to restrict access to sensitive internal web applications from iOS Chrome browsers until the patch is applied - for example, by enforcing browser version checks at the application layer or through MDM policy. Note that blocking iOS Chrome at the network perimeter may degrade user experience and is not a permanent solution. No configuration-level workaround within Chrome for iOS itself has been identified to mitigate this specific flaw.
Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today