EUVD-2026-50710
GHSA-hmjv-q65w-xfr7
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Network-delivered with no auth required; user must browse to malicious content (UI:R); UXSS impact is limited to confidentiality and integrity with no availability effect.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via malicious network traffic. (Chromium security severity: Medium)
AnalysisAI
Universal Cross-Site Scripting (UXSS) in Google Chrome for iOS prior to 151.0.7922.72 enables remote attackers to inject arbitrary scripts or HTML across origin boundaries via crafted malicious network traffic, requiring only passive user interaction such as visiting a compromised page. The vulnerability stems from insufficient input validation (CWE-20) in the iOS-specific Chrome codebase, which uses Apple's WebKit engine rather than Blink. No public exploit code has been identified and CISA KEV does not list this vulnerability; EPSS probability sits at 0.19%, placing it in the 9th percentile of exploitation likelihood.
Technical ContextAI
Chrome for iOS is architecturally distinct from Chrome on Android or desktop because Apple's App Store policies mandate use of the WebKit rendering engine rather than Chrome's native Blink/V8 stack. CWE-20 (Improper Input Validation) indicates that the browser's input-processing pipeline fails to adequately sanitize or reject untrusted data arriving via network traffic before passing it into script or HTML rendering contexts. UXSS (Universal Cross-Site Scripting) is a particularly severe class of XSS because it bypasses the Same-Origin Policy at a browser level rather than within a single site - successfully injected scripts can read cookies, local storage, and DOM state from any loaded origin, not just the attacker-controlled one. The CPE entry cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Google Chrome versions broadly; the EUVD narrows the affected range to Chrome for iOS versions below 151.0.7922.72. A discrepancy exists in the references: both advisory URLs reference a 'stable-channel-update-for-desktop' blog post, which may indicate the iOS release notes are bundled in the same publication, or may reflect a metadata error - defenders should verify directly against the iOS App Store release notes.
RemediationAI
The primary fix is to update Google Chrome for iOS to version 151.0.7922.72 or later, available through the Apple App Store. The vendor advisory is available at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Patch availability is confirmed per vendor; the exact fix version 151.0.7922.72 is sourced from EUVD data. If immediate patching is not possible, organizations can reduce exposure by restricting access to untrusted networks (e.g., disabling auto-connect to public Wi-Fi), as the attack requires malicious network traffic delivery. Deploying a trusted VPN on iOS devices prevents network-level interception but does not eliminate exposure to malicious web content. No configuration toggle is known to disable the vulnerable input-validation path while preserving normal browsing functionality.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Code Injection
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today