Chrome for iOS EUVD-2026-50710

The vulnerability is confined to Google Chrome on iOS - Chrome on Android, Windows, macOS, or Linux is not affected by this specific flaw. User interaction is required (UI:R per CVSS vector): the victim must actively browse to or be redirected to a page served via malicious network traffic. No authentication is required from the attacker's perspective (PR:N). The attack is network-based (AV:N), so the attacker must be able to deliver crafted network responses to the victim - either via MitM on a shared or hostile network, DNS poisoning, or a malicious origin the victim navigates to. No non-default configuration is indicated as a precondition; standard Chrome for iOS browsing is sufficient. Exploitation is limited by: the iOS-only scope of the vulnerability, the requirement for user-initiated browsing activity, and the need for the attacker to control or intercept network traffic reaching the device.

The CVSS 3.1 score of 5.4 (Medium) reflects a network-reachable, low-complexity attack requiring no authentication (PR:N) but mandating user interaction (UI:R). The unchanged scope (S:U) and limited impact metrics (C:L/I:L/A:N) cap the base score, though UXSS's cross-origin nature is arguably underrepresented by S:U - a successful UXSS bypass could access session tokens or sensitive data from any origin the victim has open, which functionally resembles a scope-changing impact. EPSS at 0.19% (9th percentile) indicates very low current exploitation probability, and the absence of a CISA KEV listing means no confirmed in-the-wild exploitation. No public proof-of-concept code is referenced in available intelligence. Overall, this is a moderate-priority patching item rather than an emergency response: the iOS-specific scope limits the affected population, no active exploitation is confirmed, and the fix is a routine browser update. The 'Chromium security severity: Medium' classification from the Chrome security team is consistent with available signals.

An attacker positioned as a man-in-the-middle on the victim's network, or operating a malicious web server, injects crafted HTTP responses containing improperly encoded or structured HTML and script payloads toward a user running Chrome for iOS below 151.0.7922.72. When the victim browses to any page served through that malicious network path, Chrome's insufficient input validation allows the injected payload to execute as JavaScript across origin contexts in the browser. The attacker can then exfiltrate session tokens, cookies, or sensitive DOM content from other tabs or origins open in the browser. No public proof-of-concept has been identified at time of analysis.