EUVD-2026-50763
GHSA-8p2g-mp84-gmvm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious HTML page
-
DeliveryHost on attacker-controlled domain
-
ExploitLure iOS Chrome user via phishing or malvertising
-
ExecutionUser loads crafted page in Chrome for iOS
-
PersistTrigger insufficient input validation in navigation subsystem
-
ImpactBypass navigation restrictions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires the target to be running Google Chrome on Apple iOS with a version strictly below 151.0.7922.72 - this vulnerability does not apply to Chrome on Android, Windows, macOS, or Linux. The victim must actively load a crafted HTML page delivered by the attacker, consistent with the UI:R metric in the CVSS vector; exploitation cannot occur passively without user interaction. No authentication is required from the attacker's perspective (PR:N). Limiting factors include: the iOS-only platform constraint (excluding the majority of Chrome's total user base), mandatory user interaction to trigger the flaw, and an impact limited to integrity (navigation manipulation) with no confidentiality or availability consequences, which reduces the attractiveness of the target for high-value attacks. Non-default configurations are not required - any iOS Chrome user below the fix version visiting a malicious page is potentially affected. |
| Impact | The CVSS 6.5 Medium score reflects a network-accessible, zero-prerequisite attack limited by required user interaction (UI:R) and a scope-unchanged impact boundary. The high integrity impact (I:H) with no confidentiality or availability consequences indicates that while an attacker can manipulate navigation behavior, they cannot directly exfiltrate data or cause denial of service - narrowing the threat model primarily to navigation hijacking or policy bypass scenarios. EPSS at 0.22% (13th percentile) is notably low, and the absence of a CISA KEV listing or reported POC collectively signal that real-world exploitation risk is currently low. The iOS-platform specificity further constrains the attack surface to a subset of Chrome's overall user base. The primary risk vector is targeted phishing or malicious advertisement delivery to iOS Chrome users, rather than opportunistic mass exploitation. No conflicting signals exist between the CVSS vector and the description - both consistently indicate remote exploitation via crafted content requiring user interaction. |
| Exploit ScenarioDerived | An attacker crafts a malicious HTML page that exploits the input validation flaw in Chrome for iOS's navigation subsystem and hosts it on an attacker-controlled domain. The victim, running an unpatched version of Chrome on an iOS device, is directed to the page via a phishing link, malicious advertisement, or redirect chain. Chrome for iOS processes the crafted input and bypasses navigation restrictions, potentially allowing the attacker to redirect the browser to restricted internal URLs, bypass same-origin navigation policies, or manipulate the user's browsing session without their awareness. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 31, 2026
Navigation restriction bypass in Google Chrome for iOS (versions prior to 151.0.7922.72) enables unauthenticated remote attackers to circumvent browser navigation controls by inducing a user to load a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) confirms network-accessible, low-complexity exploitation with no privilege requirements but mandatory user interaction, yielding high integrity impact with no confidentiality or availability consequences. No public exploit identified at time of analysis, and EPSS at 0.22% (13th percentile) indicates limited near-term exploitation likelihood despite the medium severity rating.
RemediationAI
Upgrade Google Chrome on iOS to version 151.0.7922.72 or later, which constitutes the vendor-released patch for this vulnerability per the stable channel advisory at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. iOS users should update through the Apple App Store. For enterprise environments unable to immediately deploy the patch, Mobile Device Management (MDM) solutions can be used to restrict Chrome navigation to approved domain allowlists, though this introduces significant usability trade-offs and will not prevent exploitation via allowed domains hosting malicious content. Restricting user access to untrusted web content via web proxies or DNS filtering reduces exposure but does not constitute a complete mitigation. No workaround is confirmed as fully effective absent the patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is rooted in CWE-20 (Improper Input Validation) within Chrome's iOS-specific navigation processing code path. Unlike desktop Chrome or Chrome on Android, Chrome for iOS is constrained by Apple App Store policies to use WebKit as its underlying rendering engine, introducing a platform-specific code layer where input sanitization for navigation requests was found to be insufficient. The affected CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) covers the Chrome application broadly, but the vulnerability is explicitly scoped to the iOS variant per the CVE description. The flaw allows attacker-supplied HTML content to manipulate or bypass navigation restrictions - which could encompass same-origin navigation guards, URL scheme enforcement, or browser-internal navigation policy controls. The EUVD entry EUVD-2026-50763 confirms the affected version range as all Chrome for iOS releases prior to 151.0.7922.72.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Network delivery via crafted HTML requires no privileges, but UI:R applies as user must load the page; navigation bypass yields I:H with no confidentiality or availability impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB