Chrome iOS EUVD-2026-65918

Exploitation requires a user running Google Chrome Mobile on iOS (prior to 152.0.7977.65) to actively navigate to or be redirected to an attacker-controlled HTML page - this is the UI:R gate. No authentication or prior account access is required from the attacker's side (PR:N). The vulnerability is specific to the iOS platform; Chrome on other operating systems (Android, desktop) is not stated as affected. Impact is limited to integrity (I:L) - the attacker can bypass system access restrictions but cannot read sensitive data (C:N) or cause a denial of service (A:N). Exploitation is constrained to the browser's scope (S:U), meaning a successful bypass does not pivot to OS-level compromise.

The CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) accurately reflects a moderate, network-reachable flaw with constrained real-world impact: no confidentiality exposure, low integrity impact, and a hard dependency on user interaction (visiting an attacker-controlled page). EPSS at 0.23% (13th percentile) corroborates low exploitation interest in the wild. The vulnerability is not listed in the CISA KEV catalog, and no POC code has been identified. Attack complexity is low once a user visits the page, but the UI:R gate and S:U (no scope change) meaningfully reduce blast radius. Overall this is a genuine but lower-priority item for most organizations - patch it in the normal update cycle rather than treating it as an emergency. The mismatch between the iOS-specific description and a CPE string that covers all Chrome platforms warrants verification with the vendor.

An attacker hosts a crafted HTML page designed to trigger the incorrect authorization path in Chrome's iOS mobile code. A user on an iPhone or iPad opens the page in Chrome, at which point the page bypasses iOS system access restrictions that would normally limit what a remote web origin can do, enabling a limited unauthorized action - such as invoking a restricted API or accessing a controlled resource - without the user's consent. No public POC exists, so successful exploitation currently requires independent rediscovery of the authorization bypass mechanism.