EUVD-2026-50591
GHSA-8737-76mx-jgwh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted HTML page to iOS Chrome user
-
DeliverySocially engineer specific UI gestures
-
ExploitTrigger origin validation flaw
-
ExecutionBypass same-origin policy
-
ImpactManipulate or access cross-origin content
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Origin validation
|
| Exploitation Conditions | Exploitation requires that the victim is running Google Chrome on an iOS device at a version prior to 151.0.7922.72 and that an attacker can convince the user to perform specific UI gestures (such as taps or swipes) on a crafted HTML page-this is the central social-engineering prerequisite. The CVSS vector (PR:N, UI:R) confirms no authentication to the target system is needed by the attacker, but active user participation in gesture interaction is mandatory. Exploitation is limited to the iOS platform; desktop or Android Chrome users are not affected by this specific implementation flaw. Non-default configurations are not required-any standard iOS Chrome user browsing to a malicious page could be targeted if the gesture interaction is achieved. |
| Impact | The CVSS 3.1 base score of 6.5 (Medium) is consistent with the vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N: the attack is network-delivered, low complexity, requires no authentication, but critically depends on the victim performing specific UI gestures (UI:R), which meaningfully reduces automated exploitability. The integrity impact is rated High, reflecting the ability to violate SOP and manipulate cross-origin content, while confidentiality and availability are unaffected per the vendor assessment. EPSS at 0.19% (9th percentile) indicates very low automated exploitation likelihood, consistent with the UI interaction requirement. There is no CISA KEV listing and no public POC code identified, so this is not a priority for emergency patching but remains a meaningful risk for targeted social-engineering scenarios against iOS Chrome users. The 'Authentication Bypass' tag in the intelligence data aligns with SOP circumvention semantics. The scope is limited to the iOS Chrome client; desktop and Android builds are not addressed by this CVE. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page and distributes it via phishing, malvertising, or a compromised site, then socially engineers an iOS Chrome user into performing a sequence of UI gestures (e.g., tapping or swiping a disguised interactive element). These gestures trigger the origin validation flaw, allowing the attacker's page to bypass SOP and interact with or modify content from a different origin loaded in the same browser session-such as an authenticated banking or webmail page open in another tab. No public POC has been identified, making exploitation at this time dependent on independent vulnerability research. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 31, 2026
Same-origin policy bypass in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to violate cross-origin isolation by luring a user into performing specific UI gestures on a crafted HTML page. The flaw stems from CWE-346 (Origin Validation Error) in an iOS-specific Chrome implementation, granting unauthorized write-level access to cross-origin content. No public exploit code has been identified and no active exploitation is confirmed; with an EPSS of 0.19% (9th percentile), real-world exploitation probability remains low but the integrity impact is high if successfully triggered.
RemediationAI
Update Google Chrome on iOS to version 151.0.7922.72 or later via the Apple App Store; this is the vendor-released patch confirmed by the Chrome stable channel advisory at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. As a compensating control prior to patching, organizations can advise iOS users to avoid visiting untrusted or unfamiliar web pages and to be cautious of pages that prompt them to perform unusual tap, swipe, or gesture interactions-the specific UI actions exploitable in this flaw. Restricting access to sensitive authenticated web applications from unpatched iOS Chrome builds is a secondary mitigation with low operational overhead. No workaround eliminates the root cause; the patch is the only confirmed remediation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-346 (Origin Validation Error) describes failures in properly verifying the origin of a message or request before acting on it. In this case, an 'inappropriate implementation' within Chrome's iOS-specific codebase mishandles origin validation when the user performs specific UI gestures-likely swipe, tap, or drag interactions that Chrome for iOS interprets differently from the desktop engine. This creates a pathway for a crafted page to sidestep the Same-Origin Policy (SOP), the foundational browser security boundary preventing one origin from reading or modifying resources belonging to another. The CPE cpe:2.3:a:google:chrome:* encompasses all Chrome variants, but the description and context narrow the affected surface to the iOS platform specifically, where the Blink/WebKit rendering integration differs from desktop builds. The ENISA EUVD entry (EUVD-2026-50591) corroborates the version boundary at 151.0.7922.72.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Network-delivered via crafted page; no privileges needed; mandatory user gesture interaction (UI:R); integrity high for SOP bypass; no confidentiality or availability impact evident.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-346 – Origin Validation Error
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB