EUVD-2026-93686
GHSA-86jw-c9h3-g3r5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim via social engineering
-
DeliveryDeliver crafted HTML page
-
ExploitVictim opens page in Reader Mode
-
ExecutionTrigger code injection in ReaderMode
-
PersistBypass web origin policy
-
ImpactAccess cross-origin content
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to be running Google Chrome on iOS prior to 155.0.8059.39 and to open an attacker-crafted HTML page in the browser's Reader Mode feature; the flaw lives in Reader Mode's handling of page content. Limiting factors: success depends on social engineering to get the user to navigate to the malicious page (effective user interaction), it is confined to the iOS Chrome build rather than desktop Chrome, and impact is limited to bypassing the web origin policy (partial confidentiality/integrity/availability), not full code execution or system compromise. |
| Impact | Signals point to a low-to-moderate real-world priority despite the 7.3 (High) CVSS. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) describes a network, low-complexity, unauthenticated attack with no user interaction, yet the NVD/Chrome description explicitly states exploitation requires 'leveraging social engineering' and a 'crafted HTML page' - this is a direct conflict: the description implies user interaction (visiting a malicious page) that the UI:N metric omits. Treat UI:N as likely understated and assume user interaction is in practice required. Impact is limited (C:L/I:L/A:L, scope unchanged), consistent with Chromium's own 'Medium' severity rating rather than the aggregator's High. EPSS is low (0.27%, 17th percentile), there is no CISA KEV listing, and no public exploit is identified, so there is no evidence of active or imminent exploitation. Net: a legitimate browser-security fix worth patching on normal cadence, not an emergency; the elevated numeric CVSS overstates urgency relative to the vendor severity, low EPSS, and absence of KEV/POC. |
| Exploit ScenarioDerived | An attacker crafts a malicious HTML page and lures an iOS Chrome user to open it in Reader Mode (via phishing or a deceptive link). The injected code exploits Reader Mode's rendering to bypass the web origin (same-origin) policy, allowing limited read/modify access to content from another origin in the victim's session. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Code injection in the Reader Mode feature of Google Chrome on iOS (versions prior to 155.0.8059.39) lets a remote, unauthenticated attacker bypass the web origin policy by convincing a victim to open a crafted HTML page in the browser. The flaw is confined to the iOS build and depends on social engineering to drive the victim to the malicious page, so effective user interaction is required; impact is limited to a partial confidentiality, integrity and availability loss through origin-policy circumvention rather than full system compromise. No public exploit code has been identified at time of analysis, EPSS is a low 0.27% (17th percentile), and the issue is not listed in CISA KEV, so despite the 7.3 High CVSS the real-world priority is low-to-moderate. Google has shipped a vendor patch, fixed in Chrome 155.0.8059.39.
RemediationAI
Vendor-released patch: Chrome for iOS 155.0.8059.39 (and later), as documented in the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html; update affected iPhones and iPads through the App Store or, in managed fleets, push the minimum version via MDM/App Store volume purchasing and verify enforcement, since users on builds below 155.0.8059.39 remain exposed. If immediate update is not possible, the practical compensating control is to avoid invoking Reader Mode on untrusted or unsolicited links and to treat Reader Mode rendering of externally supplied pages as untrusted until the device is updated - an effective but user-dependent measure whose trade-off is degraded usability of the reader feature and reliance on user discipline against the social engineering this flaw requires. Enterprise controls can help by blocking or warning on redirects to untrusted domains at the network/DNS layer and by tightening Safe Browsing or managed-URL policies, though these only reduce the chance of the crafted page being reached and introduce false positives on legitimate content, and they do not fix the underlying origin-policy bypass. Because exploitation requires the victim to open the crafted HTML page, targeted phishing awareness training for iOS Chrome users is a low-cost, partial mitigation. No public exploit code has been identified at time of analysis, so emergency out-of-band actions are not warranted; standard patch-cycle deployment of 155.0.8059.39 is sufficient.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a code-injection defect (CWE-94) located in Chrome's Reader Mode, a content-reformatting feature that parses and re-renders a page's main article content. Because Reader Mode ingests and processes attacker-controllable HTML before re-serializing it, insufficient neutralization of that content allows injected code to execute within the Reader Mode rendering context instead of being treated as inert content. The security consequence described by the vendor is a bypass of web origin policy: injected code can act across an origin boundary it should not be able to reach, which is why the assessed impact is partial confidentiality, integrity and availability rather than arbitrary device compromise. Affected components map to the CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* and, per ENISA EUVD (EUVD-2026-93686), to Chrome builds before 155.0.8059.39. The defect is specific to the iOS platform build of Chrome; desktop and other platform builds are not implicated by this advisory. Chromium rated the issue Medium severity while NVD scoring assigns 7.3, and our independent assessment adjusts the vector to reflect the mandatory user interaction (UI:R) needed to load the crafted page.
Know when iOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Social engineering and a crafted page the victim must open make UI:R rather than UI:N; remote and unauthenticated with limited partial impacts keeps AV:N/PR:N and C/I/A:L.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Code injection in ReaderMode in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Organizations with employees using Google Chrome on iOS are exposed to a high-severity code injection flaw in the Reader Mode feature that could allow a malicious webpage to bypass web origin protections, potentially leading to limited data exposure or manipulation. While no public exploit code has been identified and the attack requires user interaction, the prevalence of iOS devices in the workforce makes prompt patching important to maintain security posture. Leadership should prioritize updating Chrome to version 155.0.8059.39 to mitigate this risk.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
A use-after-free issue was addressed with improved memory management. Rated high severity (CVSS 7.8), this vulnerability
The DLSw implementation in Cisco IOS does not initialize packet buffers, which allows remote attackers to obtain sensiti
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
AirKeyboard iOS App 1.0.5 contains a missing authentication vulnerability that allows unauthenticated attackers to type
Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mo
A vulnerability in the Cisco IOx application hosting environment of multiple Cisco platforms could allow an authenticate
Arbitrary code execution in Jellyfin iOS GitHub Actions workflow. CVSS 10.0.
Memory corruption vulnerabilities in Apple's graphics texture processing engine across iOS, iPadOS, macOS, tvOS, visionO
Buffer overflow memory corruption in Apple file parsing components allows remote code execution across iOS 18.6, iPadOS
A use-after-free issue was addressed with improved memory management. Rated critical severity (CVSS 9.8), this vulnerabi
Cisco IOS 15.5(3)M on Integrated Services Router (ISR) 800, 819, and 829 devices allows remote attackers to cause a deni
Exploit-DB