EUVD-2026-34763
GHSA-p8xv-rjmj-8264
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious HTML page
-
DeliveryHost and deliver URL to target (phishing/social engineering)
-
ExploitTarget opens URL in Chrome for iOS
-
ExecutionPage triggers policy enforcement flaw
-
PersistBypass discretionary access control
-
ImpactAchieve limited integrity modification
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | User interaction is required - the victim must actively visit a crafted HTML page in Chrome for iOS (UI:R per CVSS vector). No authentication is required from the attacker's side (PR:N). Exploitation is limited exclusively to the iOS build of Chrome; all other platforms are unaffected. The access control bypass yields only integrity impact (I:L) with no confidentiality or availability consequence, and scope does not change beyond the vulnerable component (S:U). The non-automatable SSVC designation and user-interaction requirement together limit the realistic threat to targeted delivery scenarios such as spearphishing rather than opportunistic mass exploitation. |
| Impact | Real-world risk is low across all available signals. CVSS 4.3 with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N captures a network-reachable, low-complexity attack requiring user interaction, yielding only limited integrity impact with no confidentiality or availability consequence. Chromium's own severity classification is 'Low', aligning with the numeric score. EPSS at 0.02% (4th percentile) indicates negligible observed exploitation probability relative to the broader CVE population. SSVC confirms exploitation status as 'none', automatable as 'no' (consistent with UI:R), and technical impact as 'partial'. This is not a prioritization candidate for emergency patching - it is a routine update item for iOS Chrome fleet managers. No conflicting signals are present; all sources converge on a low-urgency assessment. |
| Exploit ScenarioDerived | An attacker hosts a specially crafted HTML page on an attacker-controlled web server and delivers the link to a target via phishing email, SMS, or social media. When the victim opens the link in Chrome for iOS, the crafted page triggers the insufficient policy enforcement flaw, bypassing discretionary access control and allowing the attacker to make limited unauthorized modifications to browser-accessible content or state. No public exploit code is known to exist, and the user-interaction requirement prevents fully automated exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 05, 2026
Insufficient policy enforcement in Google Chrome for iOS (prior to 149.0.7827.53) allows remote unauthenticated attackers to bypass discretionary access controls via a crafted HTML page, resulting in limited integrity impact. User interaction is required, and exploitation probability is extremely low - EPSS sits at 0.02% (4th percentile). No public exploit identified at time of analysis, and Chromium's own security team rated this as 'Low' severity, consistent with the CVSS 4.3 score and SSVC's 'partial' technical impact assessment.
RemediationAI
Update Google Chrome for iOS to version 149.0.7827.53 or later, available through the Apple App Store. This is the vendor-released patch confirmed by the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. No workaround is documented. If immediate patching is not feasible in managed environments, restricting user access to untrusted or externally-hosted HTML content via Mobile Device Management (MDM) policy - for example, URL allowlisting through browser management profiles - can reduce exposure, though this may impact user productivity. Given the low severity and the absence of active exploitation, emergency compensating controls are not warranted; standard patch cycle management is appropriate.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is rooted in CWE-284 (Improper Access Control), specifically insufficient enforcement of discretionary access control policies within Chrome's iOS-specific rendering or content handling layer. Chrome for iOS operates under Apple's WKWebView framework rather than Blink's full desktop sandbox, which introduces platform-specific policy enforcement paths that may diverge from desktop Chrome behavior. The crafted HTML page delivery vector suggests the flaw lies in how web content triggers or interacts with internal Chrome iOS policy checks. The CPE context (iOS-specific builds prior to 149.0.7827.53, confirmed via EUVD) means this does not affect Chrome on Android, Windows, macOS, or Linux - only the iOS distribution is in scope.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Low)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Related Vulnerabilities in Google Chrome Security Fixes (149.0.7827.53)
View all 72Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Exploit-DB