Google Chrome: Incorrect authorization in Selection on iOS
Summary
Google Chrome on iOS contains an incorrect authorization flaw in the Selection component. A remote attacker can obtain sensitive information by luring a user to a crafted HTML page. Exploitation requires that the user opens the page, so the risk depends on browsing behaviour rather than on exposed services. Google rates the bug Low, while the CVE record lists a CVSS 3.1 base score of 8.8.
Affected
- Google Chrome on iOS prior to 155.0.8059.39 (according to the CVE record)
- Desktop builds before 155.0.8059.39 (Windows, Mac, Linux) are also listed as affected by the Chrome 155 security update
Fixed in
- Desktop: 155.0.8059.39/.40 for Windows and Mac, 155.0.8059.39 for Linux (secondary reporting)
- iOS: Unconfirmed. Secondary reporting states that Chrome 155 reached iOS as 155.0.8059.37, which is below the 155.0.8059.39 threshold. Verify the fixed build in the Chrome for iOS release notes or App Store version history.
Workaround
No vendor-documented workaround. Updating Chrome is the remedy.
Exploitation
- No known exploitation. A third-party mirror of CISA ADP Vulnrichment data does not mark the CVE as known exploited.
- No public proof of concept found.
- Google has not stated whether this bug was exploited in the wild.
Our recommendation
- Update Chrome on iOS to the latest version available in the App Store and confirm that automatic updates are enabled.
- Check MDM compliance for Chrome build numbers on managed iOS devices and treat builds below 155.0.8059.39 as non-compliant until the iOS fixed build is confirmed.
- Update desktop Chrome installations to 155.0.8059.39 or later as part of the regular update cycle.
- Recheck the NVD status and the Chromium issue tracker before using this entry for a compliance decision.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
- Chromium issue 503708636 issues.chromium.org
- Chrome 155 release notes (chromestatus) chromestatus.com
- OSV: DEBIAN-CVE-2026-106309 osv.dev
- gHacks: Google releases Chrome 155 with 247 security fixes www.ghacks.net
- CVE-2026-106309 threatint mirror cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 21:56.
Original description (NVD)
Incorrect authorization in Selection in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.