EUVD-2026-40594
GHSA-fm3f-gr7p-wvjh
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Network delivery via malicious traffic (AV:N), no privileges needed (PR:N), but specific UI gestures required (UI:R); impact is integrity-only navigation bypass with no confidentiality or availability consequence.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Insufficient validation of untrusted input in Omnibox in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass navigation restrictions via malicious network traffic. (Chromium security severity: Medium)
AnalysisAI
Navigation restriction bypass in Google Chrome's Omnibox on iOS (prior to 150.0.7871.47) enables a remote attacker to circumvent address bar security controls through insufficient input validation, contingent on user interaction with specific UI gestures during exposure to malicious network traffic. The integrity impact is rated High (I:H) with no confidentiality or availability impact, consistent with a content/navigation spoofing class of vulnerability. No public exploit code or CISA KEV listing has been identified; EPSS score of 0.20% (10th percentile) indicates low observed exploitation probability at time of analysis.
Technical ContextAI
The Omnibox is Chrome's combined address and search bar, responsible for parsing, validating, and rendering URLs before navigation. CWE-20 (Improper Input Validation) identifies the root cause: the iOS-specific Omnibox implementation fails to adequately validate untrusted input delivered via malicious network traffic, allowing attacker-controlled data to influence navigation behavior in ways that bypass built-in restrictions (e.g., same-origin enforcement, navigation guards, or URL display integrity). The vulnerability is scoped to the iOS platform variant of Chrome only - desktop Chrome and Android Chrome are not referenced as affected. The affected CPE-equivalent scope covers Google Chrome on iOS for all versions prior to 150.0.7871.47 as identified in the EUVD data.
RemediationAI
The primary fix is to upgrade Google Chrome on iOS to version 150.0.7871.47 or later, available through the Apple App Store. The vendor advisory is published at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. As an interim control for organizations unable to immediately update, enforcing mobile device management (MDM) policies to restrict browsing to trusted networks or enabling DNS filtering to block known malicious domains can reduce exposure to the malicious network traffic prerequisite. These controls carry the trade-off of reduced browsing flexibility and may not prevent exploitation in environments with attacker-accessible Wi-Fi or cellular interception. No compensating control fully substitutes for patching given the network-delivered attack vector.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today