EUVD-2026-50829
GHSA-w9vw-56mm-f3qr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconCraft malicious HTML page with navigation bypass payload
-
DeliveryHost on attacker-controlled site
-
ExploitLure iOS Chrome user via phishing or redirect
-
InstallUser visits page in Chrome for iOS
-
C2Crafted content triggers insufficient policy enforcement
-
ExecuteNavigation restrictions bypassed
-
ImpactUser redirected to restricted or unauthorized resource
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V4 - API and Web Service Server-side security enforcement
|
| Exploitation Conditions | The victim must be running Google Chrome on iOS (not Safari, not Chrome on Android or desktop) with a version prior to 151.0.7922.72. Exploitation requires the victim to actively visit a crafted HTML page delivered by the attacker (UI:R per CVSS), making drive-by mass exploitation less practical. No authentication or special server-side configuration is required of the victim - the attack is unauthenticated and network-delivered (PR:N, AV:N). The navigation restriction bypass is specific to Chrome's iOS code path, meaning the same HTML payload would not exploit desktop Chrome. Limiting factors include: mandatory user interaction to navigate to the attacker's page, iOS platform exclusivity narrowing the target population, non-automatable SSVC classification ruling out worm-like propagation, and no confirmed active exploitation at time of analysis. |
| Impact | The CVSS 6.5 Medium score (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) captures a network-reachable, low-complexity flaw requiring no authentication but mandating active user interaction (visiting a crafted page), with impact confined to integrity. This aligns with the SSVC assessment: exploitation none, automatable no, technical impact partial - meaning the flaw is not currently being weaponized and cannot be trivially mass-exploited. The EPSS score of 0.30% (23rd percentile) reinforces low near-term exploitation probability. The Chromium team's internal High severity designation likely reflects the strategic importance of navigation policy integrity on mobile platforms, particularly for enterprise MDM-managed devices, rather than an imminent mass-exploitation risk. There is no score inflation risk here - the Medium CVSS and low EPSS are consistent with each other. No conflicting signals are present, though the specific navigation restriction mechanism exploited is not detailed in public disclosures, leaving exact exploitation mechanics inferred rather than confirmed. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page on an attacker-controlled domain and socially engineers a Chrome for iOS user into visiting it via phishing, malicious advertisement, or a redirect chain. Upon page load, the crafted content exploits the insufficient policy enforcement to bypass the browser's navigation restrictions, potentially redirecting the user to a restricted resource, circumventing enterprise URL filters, or bypassing authentication-gated navigation flows. No public exploit code has been identified at time of analysis, and the non-automatable SSVC classification indicates this requires targeted delivery rather than opportunistic mass exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Navigation restriction bypass in Google Chrome on iOS prior to 151.0.7922.72 allows a remote, unauthenticated attacker to circumvent the browser's built-in navigation policy controls by delivering a specially crafted HTML page. Rooted in CWE-602 (Client-Side Enforcement of Server-Side Security), the flaw reflects an iOS-specific policy enforcement gap not present in desktop Chrome builds. The Chromium team rated this High severity internally; however, no confirmed active exploitation exists - CISA KEV is absent, EPSS stands at 0.30%, and SSVC classifies exploitation as none with partial technical impact.
RemediationAI
Upgrade Google Chrome on iOS to version 151.0.7922.72 or later, which is confirmed as the vendor-patched release per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Users should apply the update via the Apple App Store, as iOS browser updates require App Store delivery. As a short-term compensating control prior to patching, restrict browsing to trusted, known-good sites in Chrome for iOS, though this substantially limits usability. Enterprise administrators using MDM platforms (e.g., Jamf, Microsoft Intune) can enforce minimum browser version policies to detect and flag unpatched iOS Chrome installations on managed devices, reducing organizational exposure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-602 (Client-Side Enforcement of Server-Side Security) identifies the root cause: security controls that should be enforced at the policy or platform layer are delegated to client-side logic and can be subverted. In Chrome for iOS, navigation restrictions govern behaviors such as cross-origin navigation, content security policies, and enterprise or MDM-applied URL filtering. The iOS-specific Chrome code path fails to adequately enforce these policies, allowing a crafted HTML page to trigger navigation to otherwise restricted destinations. Affected products are identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* for all Chrome versions below 151.0.7922.72 on iOS. The tags 'Apple, Google, Authentication Bypass' indicate the bypass may also circumvent authentication-gated navigation flows on iOS.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Network delivery with mandatory active user interaction to visit a crafted page; no privileges needed; integrity-only impact as navigation bypass does not expose data or crash the browser.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: High)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB