EUVD-2026-40498
GHSA-q3qq-qqrh-7wxq
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
AC:H reflects mandatory specific UI gesture sequence; S:C captures UXSS same-origin policy bypass; no availability impact applies.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Universal Cross-Site Scripting (UXSS) in Google Chrome for iOS prior to 150.0.7871.47 enables a remote attacker to inject arbitrary scripts or HTML across origins by exploiting insufficient input validation triggered through specific user UI gestures on a crafted page. The scope change (S:C in CVSS) is the critical dimension here - successful exploitation bypasses the same-origin policy, potentially granting the attacker script execution in the context of arbitrary origins within the browser session. No public exploit code has been identified and EPSS sits at just 0.20% (11th percentile), indicating low observed exploitation activity despite the high-impact class of vulnerability.
Technical ContextAI
Chrome for iOS implements its rendering pipeline under Apple platform constraints, and the vulnerability stems from CWE-20 (Improper Input Validation) - a failure to adequately sanitize or validate untrusted HTML or script content received from the network under specific interactive conditions. UXSS is a class of browser-level vulnerability distinct from ordinary XSS: rather than injecting into a single target page, it exploits flaws in the browser itself to execute attacker-controlled scripts in the security context of any origin, circumventing the same-origin policy enforced by the browser engine. The affected component is Chrome for iOS specifically (not Chrome on Android or desktop), suggesting an iOS-specific code path or WKWebView integration layer is implicated. The CVSS vector AV:N/AC:H confirms network delivery but elevated attack complexity, consistent with a precondition requiring a specific sequence of user interface interactions. Tags from intelligence sources ('Code Injection', 'Google', 'Apple') align with this assessment.
RemediationAI
The primary fix is to update Google Chrome on iOS to version 150.0.7871.47 or later, available through the Apple App Store. The vendor patch is confirmed available per the Chrome stable channel release advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Because the vulnerability requires specific UI gestures and user interaction, organizations managing iOS fleets via MDM can reduce exposure in the interim by enforcing browser update policies or restricting Chrome usage on managed devices to trusted sites only. There is no known serverside workaround since the flaw is entirely client-side. End-users who cannot update immediately should exercise caution clicking links from untrusted sources, as the attack requires visiting a crafted page.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Code Injection
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today