Google Chrome for iOS: Improper input validation allows sandbox code execution
Summary
Improper input validation in the Mobile component of Google Chrome for iOS (prior to 156.0.8078.47) can be abused by a remote attacker via a crafted HTML page. According to the NVD record, an attacker could potentially execute arbitrary code inside the sandbox. The attack requires that a user visits the malicious page, for example via a link in email, chat or an advertisement, and needs no prior authentication.
Affected
- Google Chrome for iOS prior to 156.0.8078.47 (per CNA description)
- Chrome on Windows, macOS, Linux, Android and ChromeOS is not covered by this CVE
Fixed in
- Fixed in Google Chrome for iOS 156.0.8078.47 (per CNA threshold)
- Exact iOS build confirmation from the vendor post was not verified; a secondary source lists 156.0.8078.54
Workaround
No workaround known. Update Chrome to a fixed version.
Exploitation
- The Chromium security severity is Medium.
- No evidence of exploitation in the wild found; CISA SSVC assessment lists exploitation as none.
- No public proof of concept found.
- The NVD CVSS 3.1 score is 8.8; other sources list lower scores (VulDB 6.3, Vulners 5.9).
Our recommendation
- Update Chrome on all iPhones and iPads to 156.0.8078.47 or later via the App Store or MDM.
- Prioritise devices with access to company data and BYOD devices that use Chrome.
- Where possible, restrict use of unmanaged browsers on corporate devices and make users aware of phishing links.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- NVD record (mirror) vulners.com
- Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
- Chromium issue tracker issues.chromium.org
- Chrome Releases: Chrome Stable for iOS update chromereleases.googleblog.com
- VulDB entry vuldb.com
- Ubuntu security notice ubuntu.com
- Strix CVE entry www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 12:38.
Original description (NVD)
Improper input validation in Mobile in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.