Google Chrome for iOS: Missing authorization in Mobile component allows information disclosure
Summary
Missing authorization in the Mobile component of Google Chrome on iOS allows a remote attacker to obtain sensitive information. The attacker needs a victim to open a crafted HTML page, typically via social engineering such as a phishing link. The CVE record describes information disclosure only; it does not describe code execution.
Affected
- Google Chrome on iOS prior to 155.0.8059.39 (per CVE description)
- Unknown whether iOS build 155.0.8059.37 contains the fix
Fixed in
- Fixed in Chrome 155.0.8059.39 according to the CVE record
- Install the latest Chrome build from the App Store; Chrome 156 (156.0.8078.33) is reported as rolling out for iOS
- Unknown whether the iOS release 155.0.8059.37 is covered
Workaround
- No vendor workaround known. Updating Chrome is the remedy.
Exploitation
- Not listed in CISA KEV
- OffSeq: not known to be exploited in the wild
- No public proof of concept found
- EPSS about 0.003 (0.319%)
Our recommendation
- Update Chrome on all iPhones and iPads to the latest App Store version, not just 155.0.8059.39
- Push updates via MDM and verify the installed Chrome build on managed devices
- Treat unpatched devices as non-compliant, with priority for devices holding sensitive data and BYOD devices with company accounts
- Warn users about phishing links and assess this CVE together with related Chrome iOS CVEs from the same release
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
- Chromium issue tracker issues.chromium.org
- OSV: DEBIAN-CVE-2026-106387 osv.dev
- Vulners: SUSECVE-CVE-2026-106387 vulners.com
- OffSeq Radar: Chromium CVE-2026-106387 radar.offseq.com
- CISA-ADP VulnRichment summary (HOL Guard) hol.org
- Releases.sh: Google Chrome releases.sh
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 21:45.
Original description (NVD)
Missing authorization in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.