Google Chrome iOS EUVD-2026-66075

Exploitation requires that the victim is using Google Chrome Mobile on iOS - specifically a version prior to 152.0.7977.65 - and is running on an Apple iOS device. The attacker must induce the victim to visit a specially crafted HTML page (UI:R), meaning passive network interception alone is insufficient; some form of user interaction or social engineering is required. No authentication or account privileges are needed from the attacker (PR:N), but the victim must actively navigate to or be redirected to the malicious page. Exploitation is further limited to the low integrity impact boundary - confidentiality and availability are unaffected. Users on Android, desktop Chrome, or any non-iOS platform are not affected by this specific vulnerability.

The overall real-world risk is low. The CVSS base score of 4.3 (Medium) is consistent with the constrained impact profile: Integrity:Low, no Confidentiality or Availability impact, and mandatory user interaction (UI:R) that limits weaponization at scale. SSVC reinforces this - Automatable: no, Technical Impact: partial - suggesting mass exploitation is implausible. EPSS at 0.22% (12th percentile) means fewer than 1 in 500 CVEs with similar characteristics are observed being exploited in practice. There is no CISA KEV listing and no reported POC. The primary risk is targeted social engineering - a victim must be persuaded to visit an attacker-controlled page in Chrome on iOS, which constrains attacker reach. One signal worth noting: the reference advisory URL specifies a 'stable-channel-update-for-desktop' endpoint, which is inconsistent with an iOS-specific flaw; this may indicate the iOS build ships on the same version cadence as desktop, or the advisory URL is incomplete. This inconsistency should be verified with the vendor before making version-specific remediation decisions.

An attacker crafts a malicious HTML page embedding input designed to trigger Chrome's validation flaw and hosts it on an attacker-controlled site or sends a link via phishing. A victim using Chrome on iOS visits the page, causing Chrome to misprocess the input and bypass an iOS system access restriction, potentially granting the attacker's page unauthorized low-level permissions or enabling an action that should be blocked by platform controls. No public exploit code exists at time of analysis, meaning this scenario currently requires attacker-developed tooling.