Google Chrome iOS EUVD-2026-93614

Exploitation requires direct physical access to an iOS device running Google Chrome prior to version 155.0.8059.39; the attacker must be able to handle the device locally (AV:P). No network path, no authentication, and no victim interaction are involved once physical access is obtained (PR:N/UI:N). The decisive limiting factors are the need for hands-on possession of the specific device and a vulnerable Chrome iOS build - devices updated to 155.0.8059.39 or later, or kept out of untrusted physical reach, are not exposed. Impact is limited to disclosure of sensitive information (C:H); there is no integrity or availability effect.

This is a low real-world priority despite a moderate CVSS of 4.6. The CVSS vector CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N shows the dominant constraint is AV:P (Physical) - the attacker needs physical access to the device, which is the single largest limiting factor and the reason Chromium itself rates this severity as Low. While PR:N and UI:N mean no authentication or victim interaction is needed once physical access is obtained, and C:H indicates high confidentiality impact, the physical-access requirement makes mass or remote exploitation impossible. No EPSS score, KEV listing, or POC was provided in the input; absence of these is consistent with a low-severity information-disclosure issue rather than a widely-exploited flaw. There are no conflicting signals here: the network-independent physical vector aligns with the description's 'local attacker ... via physical access.' Overall this is a high-CVSS-relative-to-impact but low-real-risk issue for typical fleets, more relevant to lost/stolen/unattended-device and forensic/evil-maid threat models than to broad attack campaigns.

An attacker with temporary physical possession of an unlocked or inadequately protected iOS device running a pre-155.0.8059.39 version of Chrome interacts with the device locally to read sensitive information that Chrome exposes on the device. No exploit code was identified in the provided data, and the attack cannot be performed remotely or without hands-on access to the handset.