Description
Incorrect authorization in Selection in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
Published: 2026-10-06
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure
Action: Patch
AI Analysis

Impact

The vulnerability is an incorrect authorization during Selection in Google Chrome for iOS before version 155.0.8059.39. A malicious HTML page can be crafted so that a remote attacker can obtain sensitive information from the device. The flaw is classified as CWE-863, Improper Authorization, and the primary impact is the disclosure of confidential data.

Affected Systems

Google Chrome for iOS versions prior to 155.0.8059.39 are affected. This includes any iOS device running the browser version below the fixed build.

Risk and Exploitability

The attack requires a user to open a malicious HTML page in Chrome on iOS, making it a user‑directed threat. The CVSS score is 8.8, EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The high CVSS indicates a significant risk, although the lack of exploitation evidence suggests the risk remains moderate but warrants mitigation.

Generated by OpenCVE AI on October 7, 2026 at 00:41 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Chrome on all iOS devices to version 155.0.8059.39 or later.
  • Enable automatic updates for Chrome to ensure receipt of future patches.
  • Remove or update any older Chrome installations that remain on the device.

Generated by OpenCVE AI on October 7, 2026 at 00:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4833-1 chromium security update
Debian DSA Debian DSA DSA-6553-1 chromium security update
History

Sat, 10 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Title chromium-browser: Incorrect authorization in Selection
References
Metrics threat_severity

None

 threat_severity

Low

Wed, 07 Oct 2026 14:00:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple iphone Os
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:*
Vendors & Products Apple
Apple iphone Os

Wed, 07 Oct 2026 01:00:00 +0000

Type Values Removed Values Added
Title Incorrect Authorization in Chrome iOS Selection Allows Retrieval of Sensitive Data

Wed, 07 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Tue, 06 Oct 2026 22:00:00 +0000

Type Values Removed Values Added
Title Incorrect Authorization in Chrome iOS Selection Allows Retrieval of Sensitive Data

Tue, 06 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 06 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
Description Incorrect authorization in Selection in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
Weaknesses CWE-863
References

Subscriptions

Apple Iphone Os
Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-10-06T20:25:50.676Z

Reserved: 2026-10-06T16:34:55.162Z

Link: CVE-2026-106309

cve-icon Vulnrichment

Updated: 2026-10-06T20:16:52.932Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-06T19:17:59.120

Modified: 2026-10-07T13:42:37.237

Link: CVE-2026-106309

cve-icon Redhat

Severity : Low

Publid Date: 2026-10-06T18:41:35Z

Links: CVE-2026-106309 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-07T00:45:09Z

Weaknesses