EUVD-2026-93737
GHSA-cj8g-p87m-vh44
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious link
-
DeliveryVictim opens crafted HTML page
-
ExploitBypass missing authorization check
-
ExecutionRead cross-origin sensitive data
-
ImpactExfiltrate information to attacker
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to be socially engineered into opening an attacker-crafted HTML page in Google Chrome for iOS at a version earlier than 155.0.8059.39 (UI:R). The missing authorization check (CWE-862) is the enabling flaw; no authentication is required of the attacker (PR:N), but success is firmly limited by mandatory user interaction and by the narrow platform scope - only the iOS Chrome build is affected, not desktop or Android, and only sensitive-information disclosure is described, not code execution. The patched version 155.0.8059.39 or later closes the issue. |
| Impact | Signals conflict and must be reconciled carefully. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) rates this High, yet Chromium's own security triage labels it only Medium, and the description ('obtain sensitive information') describes a confidentiality-only impact - the I:H/A:H integrity and availability impacts in the vector are not supported by the text and appear inflated, which is why my independent assessment lowers the score. CWE-862 (Missing Authorization) combined with UI:R confirms this is not a drive-by: it requires the victim to be socially engineered into visiting a crafted HTML page, so it is attacker-initiated but victim-dependent rather than wormable. No EPSS score, no CISA KEV listing, and no public exploit were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the realistic priority is moderate - patch in the normal browser-update cycle rather than emergency out-of-band. Note the reference inconsistency: the only release-notes link points to a desktop Stable Channel update blog while the CVE explicitly concerns Chrome on iOS - verify the correct iOS advisory with Google. |
| Exploit ScenarioDerived | An attacker crafts a malicious HTML page and lures a Chrome-for-iOS user to it through phishing or a deceptive link (social engineering). When the victim opens the page, a missing authorization check in the mobile browser lets the page read sensitive information it should not be able to access. No public proof-of-concept was provided, and exploitation depends entirely on the user being tricked into visiting the attacker's page. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Sensitive-information disclosure in Google Chrome for iOS before 155.0.8059.39 allows a remote, unauthenticated attacker to abuse a missing authorization check by socially engineering a victim into opening a crafted HTML page. The independent assessment limits the impact to confidentiality (C:H/I:N/A:N), so this should be treated as an information disclosure issue rather than code execution or data tampering, and exploitation requires user interaction on the iOS build only. Vendor patch 155.0.8059.39 is available, and no public exploit code or CISA KEV active exploitation was identified in the supplied intelligence.
RemediationAI
Update Google Chrome for iOS to 155.0.8059.39 or later from the App Store, then relaunch the app so the patched build is active. The vendor advisory is https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html and the Chromium issue is https://issues.chromium.org/issues/518096516. If immediate update is not possible, compensating controls include using MDM to enforce browser update deadlines, warning users not to open untrusted HTML links in Chrome for iOS, and routing mobile browsing through a secure web gateway or DNS filter that blocks known-malicious pages; these reduce exposure but do not fix the missing authorization flaw and may produce false positives or disrupt legitimate web workflows. Because exploitation depends on social engineering and user interaction, targeted user awareness training on suspicious links and unsolicited HTML content is also relevant.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The core issue is CWE-862 Missing Authorization in the Mobile Chrome for iOS component. An attacker uses social engineering to lure the victim to a crafted HTML page, and the missing authorization check permits access to sensitive information that should have been protected. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* at the product-family level, which does not resolve the iOS-only platform scope; the EUVD affected-version string is malformed as Chrome 155.0.8059.39 <155.0.8059.39, while the description and advisory establish that builds before 155.0.8059.39 are affected. The supplied CVSS vector claims C:H/I:H/A:H, but the authoritative assessment reconciles this to CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, meaning only sensitive-information disclosure is substantiated. The vector contains PR:N and UI:R, so the attacker is unauthenticated but must convince the victim to interact with the crafted page. Patch status is vendor-released patch 155.0.8059.39.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with required user interaction (AV:N/UI:R); description limits impact to information disclosure, so C:H but I:N/A:N, unlike the inflated input vector.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Missing authorization in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome for iOS versions prior to 155.0.8059.39 contain a sensitive-information disclosure flaw that can be triggered when a user is persuaded to open a crafted web page, potentially exposing data the browser can access on that device. The impact is limited to confidentiality - there is no code execution, data tampering, or service disruption - and exploitation requires user interaction on iPhone and iPad devices, which concentrates exposure among mobile workers who routinely open links. Because a vendor fix is already available and no public exploit code has been identified, leadership should treat this as a scheduled mobile patching obligation, not a crisis.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB