EUVD-2026-50579
GHSA-26r8-m29g-9h7p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconAttacker crafts malicious HTML page
-
DeliveryHosts page on attacker-controlled server
-
ExploitDelivers link to victim via phishing or social engineering
-
InstallVictim opens link in Chrome for iOS
-
C2Crafted page triggers navigation bypass flaw
-
ExecuteNavigation restrictions circumvented
-
ImpactAttacker redirects victim to restricted or unintended URL
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the victim use Google Chrome specifically on an iOS device (iPhone or iPad) running a Chrome version below 151.0.7922.72 - Chrome on other platforms is not affected. The victim must actively open a crafted HTML page in Chrome for iOS (UI:R), which rules out fully silent or automated exploitation. No authentication, account access, or elevated privileges are needed from the attacker (PR:N). Limiting factors: the attack surface is restricted to iOS users of Chrome only; Safari, Firefox for iOS, and Chrome on other operating systems are not in scope. Enterprise environments where iOS devices use Safari as the default browser or restrict Chrome installation via MDM policy are not exposed. |
| Impact | The CVSS base score of 6.5 (Medium) reflects an accurate middle-ground risk: the attack is fully network-accessible with no prerequisite privileges or complex preconditions (AV:N/AC:L/PR:N), but it mandates user interaction - the victim must actively open a crafted page (UI:R). Scope remains unchanged (S:U) and there is no confidentiality or availability impact, isolating risk to integrity (I:H). EPSS at 0.22% (13th percentile) corroborates that exploitation is not widespread or currently attractive to threat actors. The absence of a CISA KEV entry and no identified public proof-of-concept code further reduce urgency. Real-world risk is tempered by the iOS-only scope - only users of Chrome on iPhone or iPad are exposed; Chrome on Android, macOS, Windows, and Linux are unaffected. The primary concern is abuse of navigation bypass to redirect users to unintended origins or to defeat navigation-based security controls in iOS web applications, but the mandatory user-click prerequisite prevents drive-by or fully automated mass exploitation. |
| Exploit ScenarioDerived | An attacker registers or compromises a website and embeds a crafted HTML page containing navigation-triggering logic designed to exploit Chrome for iOS's improper access control. A victim using Chrome on an iPhone clicks a link to this page - via phishing email, social media, or SMS - and the attacker's script bypasses Chrome's navigation restrictions, redirecting the user to an attacker-controlled or otherwise restricted URL without the expected security checks. No public proof-of-concept exists at time of analysis, but the low attack complexity (AC:L) means a motivated researcher could likely develop one from the Chromium issue report once it is made public. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 31, 2026
Navigation restriction bypass in Google Chrome for iOS (prior to 151.0.7922.72) enables a remote attacker to circumvent browser-enforced navigation controls by delivering a crafted HTML page. The root cause is an inappropriate implementation (CWE-284) in Chrome's iOS-specific navigation stack, meaning the flaw is isolated to the iOS platform and does not affect Chrome on Android or desktop. No public exploit code exists and EPSS probability stands at just 0.22% (13th percentile), indicating low real-world exploitation pressure at time of analysis; this vulnerability is not listed in the CISA KEV catalog.
RemediationAI
Vendor-released patch: Chrome 151.0.7922.72 for iOS. Users should update Chrome on their iPhone or iPad to version 151.0.7922.72 or later via the Apple App Store immediately, as the patch is confirmed available per the Chrome Stable Channel advisory at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Organizations managing iOS devices through MDM solutions (e.g., Jamf, Microsoft Intune) should push a managed app update policy to enforce the minimum Chrome version. As a compensating control prior to patching, restricting end users from browsing untrusted or external URLs in Chrome for iOS - for example, by enforcing managed browser policies that limit navigation to corporate-approved domains - would reduce exposure, though this may impact legitimate browsing workflows. There is no workaround that fully substitutes for the patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is rooted in CWE-284 (Improper Access Control), classified by Chromium as an 'inappropriate implementation' within Chrome's iOS navigation layer. Chrome for iOS uses Apple's WebKit rendering engine (mandated by Apple's App Store policies) but wraps it in Chromium's own navigation and security logic; the flaw likely lies in how Chrome's navigation controller enforces origin or scheme restrictions that differ from or conflict with the underlying WebKit behavior on iOS. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* with the EUVD narrowing scope to all Chrome for iOS builds below version 151.0.7922.72. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) confirms the attack is network-delivered, requires no privileges, and results exclusively in an integrity impact - consistent with a navigation policy bypass rather than memory corruption or data exfiltration.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Network-delivered via crafted page with no privileges; user must click link; impact is integrity-only as navigation restrictions are bypassed, with no confidentiality or availability loss.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB