EUVD-2026-93594
GHSA-hfwr-37rr-cxjv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSocial-engineer victim into installing malicious app
-
DeliveryCo-installed app interacts with Chrome iOS
-
ExploitTrigger improper input validation
-
ExecutionBypass web origin policy
-
ImpactTamper with cross-origin web data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires THREE combined preconditions, which sharply limits realistic risk: (1) a vulnerable Chrome for iOS build prior to 155.0.8059.39; (2) a malicious co-installed app present on the same iOS device, which the description names as the exploitation vector; and (3) active user interaction obtained via social engineering (UI:R) to reach the triggering context. Given these, the attack is targeted rather than drive-by: the attacker must first convince the victim to install the hostile companion app. Impact is limited to an integrity violation (web origin/same-origin policy bypass, I:H) with no confidentiality or availability loss (C:N/A:N). There is no default-configuration remote-unauthenticated path. |
| Impact | Signals are consistent and point to a genuinely LOW real-world priority despite the CVSS 6.5 (Medium) base score. CVSS vector is AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - network-reachable and unauthenticated (PR:N) but gated by required user interaction (UI:R), with impact limited to integrity (I:H) and no confidentiality or availability effect. EPSS is very low at 0.18% (7th percentile), and there is no public exploit identified at time of analysis - not in CISA KEV and no POC reported. SSVC reinforces this: Exploitation=none, Automatable=no, Technical Impact=partial. Google/Chromium itself rated this 'Low' severity, which is below what the 6.5 base score implies - the gap is explained by the compounding real-world preconditions (social engineering PLUS a malicious co-installed app) that the CVSS base metrics only partially capture. One note of friction to verify: the input Tags include 'Authentication Bypass,' but the description describes a WEB ORIGIN (same-origin) policy bypass, which is a distinct class from authentication bypass - treat the tag as suspect. Net: a legitimate integrity flaw worth patching in the normal cycle, not an emergency. |
| Exploit ScenarioDerived | An attacker social-engineers an iOS user into installing a malicious companion app alongside Chrome, then lures them to a crafted web context; the co-installed app abuses the improper input validation to cross Chrome's web origin boundary and tamper with data belonging to another origin. No public exploit code is known, and the multi-step precondition (user interaction plus a hostile co-installed app) makes opportunistic mass exploitation impractical. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 09, 2026
Web origin policy bypass in Google Chrome for iOS versions prior to 155.0.8059.39 lets an attacker subvert same-origin protections when a hostile companion app is installed on the same device, corrupting the trust boundary between web content and native app data. Exploitation is not drive-by: per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) it requires a vulnerable build, a malicious co-installed iOS app as the exploitation vector, and social engineering to obtain user interaction, so impact is confined to integrity (I:H) with no confidentiality or availability loss. No public exploit has been identified at time of analysis, EPSS is very low at 0.18% (7th percentile), and CISA SSVC rates exploitation as none and the issue as not automatable, making this a targeted, low real-world priority despite the 6.5 Medium base score; a vendor patch is available.
RemediationAI
Vendor-released patch: upgrade Chrome for iOS to 155.0.8059.39 or later via the App Store, and verify the installed version under Settings; the fix is documented in the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html and the Chromium issue tracker entry https://issues.chromium.org/issues/502078791. Because exploitation depends on a malicious app co-installed on the same device, the most effective compensating control for users who cannot patch immediately is to remove or avoid sideloaded and untrusted applications on the iOS device, which removes the exploitation vector entirely at the cost of restricting app installation; enterprises can pair this with MDM-managed allowlisting or blocking of unmanaged/sideloaded apps, accepting reduced user flexibility and additional administrative overhead, and can prioritize patching for users whose threat model includes targeted social engineering. Note that blocking network access or restricting web browsing will not mitigate this issue, since the bypass derives from a local co-installed app rather than a remote network path, and no server-side workaround is available.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an input-validation weakness (CWE-20) in Chrome's Mobile component on iOS, the WebKit-constrained browser platform where Chromium shares process, IPC, and inter-application surfaces with native apps on the device. Because the described vector is a co-installed application rather than a purely remote web page, the weakness sits at the boundary where Chrome for iOS parses or trusts data influenced by another app, allowing crafted input to bypass the web origin (same-origin) policy. The CPE entry cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers the Chrome product family, and the flaw is scoped to iOS builds prior to 155.0.8059.39; Chromium rates it Low severity, consistent with the SSVC 'partial' technical impact and the assessed integrity-only outcome. The CVSS vector's PR:N/UI:R combination means no credentials are needed but the victim must be socially engineered into reaching the triggering context, so the attack is targeted rather than opportunistic.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Network-reachable and unauthenticated but gated by user interaction and a malicious co-installed app, with origin-bypass causing integrity-only impact, hence UI:R, C:N/A:N, I:H.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a co-installed app. (Chromium security severity: Low)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB