EUVD-2026-93697
GHSA-56p5-jcw5-j84p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to attacker-controlled page
-
ExploitServe crafted HTML to iOS Chrome
-
ExecutionBypass web origin policy enforcement
-
ImpactAccess data from another web origin
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Protection mechanism completeness
|
| Exploitation Conditions | Requires a victim running Google Chrome on iOS at a version prior to 155.0.8059.39 who actively opens an attacker-crafted HTML page (CVSS UI:R - user interaction is the key limiting factor). No authentication and no special victim configuration are needed (PR:N, default configuration), but exploitation is constrained to the iOS Chrome build and depends on luring the user to the malicious page; it is not a server-side or self-propagating flaw. |
| Impact | Signals are consistent and point to a genuine-but-moderate priority. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U) describes a network-reachable, low-complexity, unauthenticated flaw that nonetheless requires user interaction (victim must open a crafted HTML page), which is typical for browser rendering bugs and aligns with the Chromium 'Medium' severity rating and the 6.5 base score. Exploitation-probability data agrees with the modest rating: EPSS is only 0.18% (7th percentile), there is no CISA KEV listing, and no public exploit code is referenced - so this is no public exploit identified at time of analysis, not active exploitation. No SSVC decision data was supplied. One notable discrepancy: the vendor vector sets C:N/I:H, but the vulnerability is described as a web-origin-policy (same-origin policy) bypass, which normally results in cross-origin data disclosure (a confidentiality impact) rather than integrity loss - this impact mapping should be verified with Google. Net: a legitimate browser security fix to patch in normal cadence, but not an emergency given UI:R, medium technical impact, low EPSS, and absence of KEV/POC. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page and lures an iOS Chrome user (version prior to 155.0.8059.39) to open it. The crafted HTML exploits the protection-mechanism failure to bypass the browser's web origin policy, letting the attacker's page interact with content belonging to another web origin the victim is logged into. No public proof-of-concept is referenced, and the attack requires the victim to actively visit the page. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Origin policy bypass in Google Chrome on iOS prior to version 155.0.8059.39 allows a remote, unauthenticated attacker to break the browser's cross-origin protections and reach content that should have remained isolated, provided the victim opens an attacker-crafted HTML page (CVSS 3.1 UI:R - user interaction is the limiting precondition, and the assessed impact is to confidentiality). Exploitation is confined to the iOS build of Chrome and requires luring a user to a malicious page; it is not a server-side, wormable, or self-propagating flaw, and no public exploit code has been identified at time of analysis. Risk is moderate rather than urgent: EPSS is 0.18% (7th percentile), there is no CISA KEV listing, the vulnerability is not known to be actively exploited, and Google has shipped a vendor fix in Chrome 155.0.8059.39.
RemediationAI
Vendor-released patch: upgrade Google Chrome on iOS to 155.0.8059.39 or later - this is the only complete fix and it is available now from the App Store, with the release documented at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html (bug detail at https://issues.chromium.org/issues/504227656). Because iOS Chrome updates are distributed by Apple, confirm the device has actually updated rather than relying on auto-update: on managed fleets, use MDM/App Store volume-purchase version pinning to require 155.0.8059.39 as a minimum and report on non-compliant devices. No server-side workaround exists, since the flaw is entirely client-side and triggered by page rendering; the practical interim compensating controls are (a) direct users on iOS to a browser that is not affected by this specific Chromium origin-handling defect until Chrome is updated, accepting the operational cost of session/cookie migration and enterprise SSO re-authentication, (b) on high-risk or BYOD iOS devices, restrict Chrome via MDM to a managed allow-list of internal origins or block it outright if the browser is non-essential, with the trade-off of reduced user flexibility and helpdesk load, and (c) tighten egress/DNS filtering and anti-phishing controls against the crafted-page lure, since exploitation cannot occur without the victim navigating to attacker-controlled HTML - noting this is a mitigation of delivery, not of the underlying defect. Patch status: no vendor-released patch is missing here; the fix is shipped, and the residual risk is unpatched endpoints rather than an unfixed vulnerability.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-693 (Protection Mechanism Failure): a browser-enforced security boundary - in this case the web origin policy that underpins the same-origin model - failed to hold. Origin isolation is the core containment primitive in a modern browser: it decides whether script and document handles from one origin may touch resources from another, and it gates access to cookies, storage, frames and cross-origin responses. When that enforcement path is defective, a crafted HTML page can cause the browser to treat content as same-origin or otherwise expose a document/resource that the origin policy should have protected. Notably, Chrome on iOS is not a Blink build: Apple platform rules require iOS browsers to use the WebKit/WKWebView engine, so the affected logic sits at the intersection of Chromium's iOS integration layer and the platform rendering stack, which is why the flaw is scoped to the iOS target rather than desktop or Android. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* is a broad wildcard version match, so the operative constraint is not the CPE but the EUVD version range and the vendor advisory: only Chrome on iOS below 155.0.8059.39 is affected. Google rates the Chromium-wide severity as Medium, and the CVE's published vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) and our assessed vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) agree on the exploitability envelope - network-reachable, low complexity, no privileges, mandatory user interaction - while differing on whether the consequence lands on integrity or confidentiality; the description's 'bypass web origin policy' framing is most consistent with unauthorized cross-origin read access, which is the confidentiality-weighted assessment we treat as authoritative.
Know when iOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Remote crafted page needs no privileges but requires the victim to visit it (UI:R); a web-origin-policy bypass primarily exposes cross-origin data, so C:H with no integrity/availability impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Protection mechanism failure in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
A use-after-free issue was addressed with improved memory management. Rated high severity (CVSS 7.8), this vulnerability
The DLSw implementation in Cisco IOS does not initialize packet buffers, which allows remote attackers to obtain sensiti
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
Remote code execution in Google Chrome for iOS prior to 156.0.8078.47 is possible when a victim opens a crafted HTML pag
Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mo
Hardcoded TURN relay credentials in the Girafit camera app (Android and iOS) version 1.9.1 and earlier expose a shared,
A vulnerability in the Cisco IOx application hosting environment of multiple Cisco platforms could allow an authenticate
Arbitrary code execution in Jellyfin iOS GitHub Actions workflow. CVSS 10.0.
Memory corruption vulnerabilities in Apple's graphics texture processing engine across iOS, iPadOS, macOS, tvOS, visionO
Buffer overflow memory corruption in Apple file parsing components allows remote code execution across iOS 18.6, iPadOS
A use-after-free issue was addressed with improved memory management. Rated critical severity (CVSS 9.8), this vulnerabi
Exploit-DB