EUVD-2026-40753
GHSA-48fg-hm4c-87fc
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Network-delivered via crafted HTML page (AV:N, AC:L), no attacker privileges required (PR:N), victim must visit the page (UI:R), impact is integrity-only navigation bypass with no confidentiality or availability consequence (I:L, C:N, A:N).
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Navigation restriction bypass in Google Chrome for iOS prior to 150.0.7871.47 allows a remote, unauthenticated attacker to circumvent browser-enforced navigation controls by delivering a crafted HTML page. The flaw is confined to the iOS platform - Chrome on Android, Windows, macOS, and Linux is unaffected - and requires the victim to actively visit the attacker-controlled page (UI:R). With a CVSS score of 4.3 (Medium), an EPSS of 0.19% (9th percentile), no CISA KEV listing, and a Chromium-internal severity rating of Low, this vulnerability carries minimal real-world exploitation risk but warrants patching given its zero-privilege attack vector.
Technical ContextAI
The vulnerability is rooted in CWE-20 (Improper Input Validation) within Chrome's iOS-specific navigation handling layer. Unlike desktop Chrome, which uses the Blink rendering engine directly, Chrome on iOS is built atop Apple's WKWebView framework, a sandboxed WebKit-based component mandated by Apple's App Store guidelines. Input validation failures in this context can allow crafted HTML - such as specially constructed anchor elements, JavaScript-driven location changes, or redirect constructs - to bypass navigation restrictions that Chrome enforces as security boundaries (e.g., preventing cross-origin navigations, blocking content security policy redirects, or circumventing Safe Browsing navigation guards). The affected product is Google Chrome on iOS, all versions prior to 150.0.7871.47, as confirmed by the EUVD range entry and the Google Chrome Releases advisory. The Chromium issue tracker reference 503779807 is the upstream bug report for this flaw.
RemediationAI
Update Google Chrome for iOS to version 150.0.7871.47 or later, available through the Apple App Store. The vendor advisory confirming the fix is at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Enterprise administrators managing iOS devices via MDM (e.g., Jamf, Intune) should push the Chrome update to enrolled devices and verify version compliance through the MDM console. As a compensating control for devices that cannot be updated immediately, restricting user access to untrusted or unvetted websites via a web content filter (e.g., iOS Screen Time restrictions or a corporate proxy with URL allowlisting) would reduce exposure, though this impairs general browsing and is not a substitute for patching. Auto-update should be enabled in iOS App Store settings to minimize future exposure windows. No configuration-level workaround within Chrome itself is documented by the vendor.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today