EUVD-2026-50850
GHSA-rrqv-x75g-7225
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost crafted HTML page on attacker-controlled server
-
DeliveryLure iOS Chrome user to visit page
-
ExploitTrigger race condition in browser rendering pipeline
-
ExecutionWin timing window to corrupt security context
-
PersistInject arbitrary scripts into cross-origin document
-
ImpactAccess or manipulate cross-origin session data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Concurrency control, locking
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the victim is using Google Chrome on an iOS device running a version prior to 151.0.7922.72 - Chrome on Android, macOS, Windows, or Linux is not affected by this specific vulnerability. The CVSS vector PR:N indicates no authentication is required on the attacker's side, but UI:R confirms the victim must actively visit the attacker's crafted page. AC:H reflects that the race condition is not reliably triggerable - the attacker must win a timing window, making automated mass exploitation impractical (consistent with SSVC 'Automatable: no'). No special server-side configuration or non-default browser settings are required on the victim's device; the vulnerability exists in the default Chrome for iOS installation below the patched version. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N) yields a score of 4.2, reflecting meaningful constraints: high attack complexity due to race-condition timing, mandatory user interaction, and limited confidentiality/integrity impact. EPSS at 0.16% (6th percentile) is extremely low, consistent with the AC:H requirement and zero public exploit code. SSVC categorizes exploitation as none, automatable as no, and technical impact as partial - all three signals converge to deprioritize this for emergency response. The vendor's S:U (unchanged scope) scoring warrants scrutiny: UXSS semantically implies cross-origin access, which is typically a scope change (S:C), though the vendor may have assessed per-origin impact as insufficient to trigger S:C. Taken together, this is a real but low-urgency issue - not a mass-exploitation candidate, but still worth patching given that it involves injection of arbitrary scripts in a browser context. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page designed to trigger a specific race condition in Chrome for iOS's rendering or navigation pipeline. A victim is socially engineered or redirected to visit this page in Chrome for iOS, after which the race window is won by the attacker-controlled timing, allowing injection of arbitrary scripts into a cross-origin context - potentially enabling session token theft or malicious UI manipulation in a different origin loaded in the same browsing session. No public proof-of-concept exploit code has been identified, and reliably winning the race condition adds meaningful practical difficulty. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 31, 2026
Universal Cross-Site Scripting (UXSS) in Google Chrome for iOS prior to 151.0.7922.72 allows a remote attacker to inject arbitrary scripts or HTML across origin boundaries by exploiting a race condition triggered through a crafted HTML page. The vulnerability requires user interaction and benefits from high attack complexity due to race-condition timing, placing real-world exploitation difficulty well above typical web vulnerabilities. No public exploit code exists and no active exploitation has been identified; SSVC assessment confirms exploitation status as none at time of analysis.
RemediationAI
Update Google Chrome for iOS to version 151.0.7922.72 or later, available through the Apple App Store. The patch is confirmed available per the Chrome stable channel release advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. For organizations managing iOS devices through MDM, enforce a minimum Chrome version policy to ensure fleet-wide compliance. There are no documented vendor-provided workarounds; as a compensating control prior to patching, administrators could restrict access to untrusted web content by enforcing Safe Browsing policies or web content filtering, though this introduces browsing friction and does not eliminate the attack surface. Users unable to update immediately should exercise caution when opening links from untrusted sources in Chrome for iOS.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization) underlies this flaw - a classic race condition where a timing window in Chrome's iOS rendering pipeline allows an attacker to manipulate shared state before it is properly validated or locked. The result is a UXSS condition, meaning the injected scripts can operate across multiple origins, effectively bypassing the browser's same-origin policy. On iOS, Apple's platform restrictions historically forced third-party browsers including Chrome to use WebKit as the underlying rendering engine rather than Blink/V8, making the iOS codebase distinct from desktop Chrome. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* for versions prior to 151.0.7922.72. The race window likely exists in a navigation or frame-lifecycle event handler where the security context of a document is read and written non-atomically.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
UXSS by definition crosses origin boundaries warranting S:C; race condition timing and mandatory user visit retain AC:H and UI:R respectively.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Race in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: High)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-362 – Race Condition
View allSame technique Race Condition
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB