EUVD-2026-34735
GHSA-p57h-48hh-w845
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost crafted HTML page on attacker infrastructure
-
DeliveryLure iOS Chrome user to page via phishing or malicious link
-
ExploitCrafted markup triggers DOM Distiller processing
-
ExecutionImproper access control logic fails to enforce navigation boundary
-
ImpactAttacker-directed navigation to restricted target succeeds
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to visit an attacker-controlled HTML page using Google Chrome on iOS (UI:R - user interaction is mandatory). The vulnerability is specific to the DOM Distiller (reader mode) code path on iOS; it is not confirmed present in Chrome on other platforms. No authentication or prior account access is required (PR:N). The primary limiting factors are: (1) iOS platform specificity - only Chrome users on iPhone/iPad are at risk; (2) mandatory user interaction - the victim must navigate to the crafted page; and (3) the impact is constrained to bypassing navigation restrictions with no data exfiltration or code execution capability (C:N/A:N). Non-iOS Chrome deployments are not confirmed affected. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) scores 4.3 and indicates a network-reachable, low-complexity attack requiring no privileges but mandatory user interaction, with limited integrity impact and no confidentiality or availability loss. This is consistent with a navigation bypass: an attacker can influence where a user ends up, but cannot read data or crash the browser. EPSS at 0.02% (4th percentile) reflects near-zero exploitation activity, and the vulnerability is not listed in CISA KEV. Chromium internally rated this 'Low' severity. Cross-referencing all signals, this is a low-real-world-priority finding: it is iOS-specific, requires a user to actively visit an attacker page, and produces only a limited integrity outcome. No conflicting signals between data sources were identified. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page designed to manipulate Chrome's DOM Distiller processing on iOS. When a victim opens the page in Chrome for iOS (for example, via a phishing link or malicious ad), the crafted content triggers the improper access control logic, allowing the browser to navigate to a destination that should be restricted - such as an internal chrome:// page or a cross-origin navigation that should have been blocked. No public exploit identified at time of analysis, making opportunistic mass exploitation unlikely. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 05, 2026
Navigation restriction bypass in Google Chrome's DOM Distiller component on iOS allows a remote attacker to circumvent page navigation controls by serving a specially crafted HTML page. Affected users are running Chrome on iOS prior to version 149.0.7827.53, and exploitation requires the victim to visit an attacker-controlled page. No public exploit identified at time of analysis and EPSS probability sits at 0.02% (4th percentile), consistent with the vendor's own 'Low' severity classification - real-world impact is limited to integrity degradation with no confidentiality or availability consequence.
RemediationAI
Vendor-released patch: Chrome 149.0.7827.53 for iOS. Users should update Chrome on iOS to version 149.0.7827.53 or later via the Apple App Store; this is the primary and recommended fix. The advisory is published at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. No workarounds are documented by the vendor. As an interim compensating control for environments where immediate update is not possible, disabling Reader Mode (DOM Distiller) by setting chrome://flags/#dom-distiller to Disabled would remove the vulnerable code path, though this trades off the reader-mode usability feature. Given the low severity and limited impact, emergency compensating controls are unlikely to be warranted for most organizations.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
DOM Distiller is Chrome's reader-mode subsystem that parses and reformats web content into a simplified, distillation view. It operates as a privileged internal Chrome page (chrome-distiller:// scheme) and is iOS-specific in this context, meaning the flaw exists in the WebKit/Chrome-on-iOS code path rather than the Blink renderer used on desktop. CWE-284 (Improper Access Control) is the root cause class, indicating the DOM Distiller implementation fails to correctly enforce navigation boundaries - likely allowing crafted markup to redirect the distiller context to a destination that should be restricted. The affected version range is all Chrome iOS builds prior to 149.0.7827.53, as identified in the EUVD CPE data ('Chrome 149.0.7827.53 <149.0.7827.53').
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Inappropriate implementation in DOM Distiller in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Related Vulnerabilities in Google Chrome Security Fixes (149.0.7827.53)
View all 72Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Exploit-DB