Google Chrome for iOS: Missing authorization in Navigation enables origin bypass
Summary
Missing authorization in the Navigation component of Google Chrome on iOS allows a remote attacker to bypass the web origin policy and load a privileged page through a crafted HTML page. The attacker needs a user to open the crafted page, for example through phishing or a malicious link. The CVE record rates the impact as high confidentiality and low integrity and availability impact (CVSS 3.1: 7.6).
Affected
- Google Chrome for iOS prior to 155.0.8059.39 (CVE record)
- Exact affected iOS build boundary to be confirmed, see Fixed
Fixed in
- Fixed in Chrome 155 (stable channel)
- CVE record: 155.0.8059.39. A gHacks report cites 155.0.8059.37 for iOS. Confirm the exact iOS build in Google's iOS release notes before setting a compliance target.
Workaround
Unknown. No workaround is documented in the sources. Updating Chrome is the mitigation.
Exploitation
- CISA SSVC assessment in the CVE record: Exploitation none, Automatable no, Technical Impact partial
- Google's release notes do not mention in-the-wild exploitation
- CISA ADP Vulnrichment does not mark the CVE as known exploited
- No public proof of concept found
Our recommendation
- Update Chrome on all iOS devices to the current version via the App Store
- Enable App Store auto-updates on managed devices and verify versions through MDM
- Remind staff not to open unknown links, especially when using privileged web applications on iPhones or iPads
- Monitor the CVE record and Google's iOS release notes for the confirmed fixed build
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
- Chromium issue tracker entry issues.chromium.org
- OSV: DEBIAN-CVE-2026-106196 osv.dev
- Ubuntu security: CVE-2026-106196 ubuntu.com
- gHacks: Chrome 155 security fixes www.ghacks.net
- SecurityWeek: Chrome 155 update patches 247 vulnerabilities www.securityweek.com
- CISA ADP Vulnrichment (mirror) hol.org
- Google Chrome: Update Chrome on iOS support.google.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 10:20.
Original description (NVD)
Missing authorization in Navigation in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted HTML page. (Chromium security severity: Medium)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.