EUVD-2026-93680
GHSA-4chw-f2hh-rrm3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitPage triggers incorrect authorization in Passwords
-
ExecutionBypass web origin policy
-
ImpactPerform unauthorized cross-origin action
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim using Google Chrome on iOS at a version prior to 155.0.8059.39 to open an attacker-controlled crafted HTML page; this user interaction (UI:R) is the primary limiting factor. No authentication or prior privileges are needed (PR:N), and no special victim-side configuration is indicated - the defect lies in the Passwords feature's authorization logic. Realistic risk is bounded by the need to drive the target to the malicious page and by the platform restriction to the iOS build of Chrome rather than all Chrome installs. |
| Impact | Signals are consistent and point to a genuine-but-moderate priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N, base 6.5) describes a remote, unauthenticated, low-complexity flaw whose only gating factor is user interaction, with impact confined to integrity (I:H) - consistent with a web-origin-policy bypass in Chrome's Passwords feature on iOS (CWE-863, Incorrect Authorization), rated Medium by Chromium. Threat-intel signals temper this: EPSS is only 0.20% (9th percentile), there is no CISA KEV listing, and no public exploit code is identified at time of analysis, so this is 'no public exploit identified at time of analysis' rather than active exploitation. The low EPSS and absence of KEV align with the Medium severity and the need for user interaction, indicating a real browser origin-isolation defect worth patching on normal cycles rather than an emergency. One point to verify: C:N with I:H is unusual for a credential-related feature - the vendor attributes integrity rather than confidentiality impact, so the practical consequence should be confirmed against the Chromium issue (501763586), which is typically access-restricted at time of analysis. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page and lures a victim running Chrome on iOS prior to 155.0.8059.39 to open it. Because the page exploits an incorrect authorization check in the Passwords component, it bypasses the web origin policy and can act across origins it should not reach. No public exploit code is identified at time of analysis, and the attack depends on the user actually visiting the page (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 09, 2026
Incorrect authorization in the Passwords component of Google Chrome on iOS lets a remote, unauthenticated attacker bypass web origin policy if a victim opens an attacker-controlled crafted HTML page (CVE-2026-106381, CWE-863). The flaw is confined to the iOS build of Chrome and to versions prior to 155.0.8059.39, which Google has addressed with a vendor-released patch; the assessed CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N, 6.5, Chromium severity Medium) scores high only for integrity impact, so the exposure is unauthorized cross-origin action or modification rather than confirmed credential disclosure. No public exploit code, proof-of-concept, or confirmed active exploitation was identified at time of analysis, and EPSS is low at 0.20% (9th percentile); the primary practical barrier is the required user interaction - driving a victim on iOS to load the malicious page.
RemediationAI
Upgrade Google Chrome on iOS to 155.0.8059.39 or later via the Apple App Store - this is the vendor-released patch and the authoritative fix, documented in the Chrome stable channel advisory (https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html) with the underlying report at https://issues.chromium.org/issues/501763586. Because the release is a full iOS app update rather than a server-side toggle, there is no configuration change that fully removes the defect; if immediate updating is not possible, reduce exposure by disabling the Passwords component's user-facing behavior in Chrome's settings (turn off "Save Passwords" and "Autofill Passwords") so the affected authorization path is far less likely to be exercised by a crafted page - the trade-off is loss of credential autofill convenience and friction for users who rely on Chrome's manager. Additional compensating measures are limited and blunt: restrict iOS Chrome browsing to trusted destinations and avoid following unknown links in that app, or temporarily use a different iOS browser until the update is applied, accepting the change in sync and workflow. Given EPSS of 0.20% (9th percentile) and no public exploit code or confirmed active exploitation, remediation can be scheduled through normal mobile update management, but the update should not be deferred indefinitely because the flaw is remotely reachable with a single crafted page and requires no privileges.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The defect is classified as CWE-863 (Incorrect Authorization) and resides in Chrome's built-in Passwords feature on iOS, which handles saved-credential storage, autofill suggestions, and the password-save/update UI. Because this component mediates between web content and credential-related browser functionality, a failure of its authorization checks can let a crafted HTML page operate outside the boundaries of its own origin, i.e. a web origin policy bypass in which the browser applies the wrong trust context to the requesting document. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) indicates the attack is network-delivered with no authentication and no special privileges, but requires victim user interaction, and the sole impact dimension is High integrity - the assessment does not claim confidentiality or availability loss, so the issue should be understood as unauthorized state/action manipulation through the origin-check flaw rather than outright password exfiltration. Google rates the Chromium security severity as Medium, and the affected platform is restricted by CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) and by the advisory to the iOS version of Chrome only, meaning desktop and Android Chrome builds are not in scope for this finding.
Know when iOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Remote crafted page (AV:N/AC:L/PR:N) requires the victim to open it (UI:R); origin-policy bypass yields integrity impact (I:H) with no confidentiality or availability loss and unchanged scope.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Incorrect authorization in Passwords in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
A use-after-free issue was addressed with improved memory management. Rated high severity (CVSS 7.8), this vulnerability
The DLSw implementation in Cisco IOS does not initialize packet buffers, which allows remote attackers to obtain sensiti
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
Remote code execution in Google Chrome for iOS prior to 156.0.8078.47 is possible when a victim opens a crafted HTML pag
Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mo
Hardcoded TURN relay credentials in the Girafit camera app (Android and iOS) version 1.9.1 and earlier expose a shared,
A vulnerability in the Cisco IOx application hosting environment of multiple Cisco platforms could allow an authenticate
Arbitrary code execution in Jellyfin iOS GitHub Actions workflow. CVSS 10.0.
Memory corruption vulnerabilities in Apple's graphics texture processing engine across iOS, iPadOS, macOS, tvOS, visionO
Buffer overflow memory corruption in Apple file parsing components allows remote code execution across iOS 18.6, iPadOS
A use-after-free issue was addressed with improved memory management. Rated critical severity (CVSS 9.8), this vulnerabi
Exploit-DB