Description
Missing authorization in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
Published: 2026-10-06
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure
Action: Immediate Patch
AI Analysis

Impact

A missing authorization check in Google Chrome Mobile on iOS allows a remote attacker who social engineers a user to retrieve sensitive information through a crafted HTML page. The flaw does not provide remote code execution or denial of service; it simply permits data disclosure. The stated severity is Medium according to Chromium security metrics.

Affected Systems

The vulnerability affects Chrome for iOS versions earlier than 155.0.8059.39. Users running any prior build of the browser on mobile are impacted.

Risk and Exploitability

The CVSS score is 8.8, indicating high severity. The EPSS score is not available, so the statistical probability of exploitation remains unknown. The vulnerability is not listed in CISA KEV. The most likely attack path requires a malicious web page to be opened by an end‑user, suggesting that social engineering and user awareness play a key role in exploitation. Those who can persuade users to visit or download the crafted HTML page may read confidential data.

Generated by OpenCVE AI on October 7, 2026 at 01:48 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Install Chrome version 155.0.8059.39 or later on all iOS devices
  • Ensure mobile devices receive timely updates via the App Store or enterprise patch management
  • Educate users to avoid opening unknown links or documents, and deploy safe browsing policies to block malicious content

Generated by OpenCVE AI on October 7, 2026 at 01:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4833-1 chromium security update
Debian DSA Debian DSA DSA-6553-1 chromium security update
History

Sat, 10 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Title chromium-browser: Missing authorization in Mobile
References
Metrics threat_severity

None

 threat_severity

Moderate

Thu, 08 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple iphone Os
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:*
Vendors & Products Apple
Apple iphone Os

Wed, 07 Oct 2026 02:15:00 +0000

Type Values Removed Values Added
Title Missing Authorization in Mobile iOS Google Chrome Allows Remote Information Disclosure via Crafted HTML

Tue, 06 Oct 2026 22:45:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Tue, 06 Oct 2026 22:30:00 +0000

Type Values Removed Values Added
Title Missing Authorization in Mobile iOS Google Chrome Allows Remote Information Disclosure via Crafted HTML

Tue, 06 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 06 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
Description Missing authorization in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-862
References

Subscriptions

Apple Iphone Os
Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-10-06T20:25:51.057Z

Reserved: 2026-10-06T16:37:30.042Z

Link: CVE-2026-106387

cve-icon Vulnrichment

Updated: 2026-10-06T20:16:58.955Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-06T19:18:07.960

Modified: 2026-10-08T17:16:03.890

Link: CVE-2026-106387

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-06T18:41:26Z

Links: CVE-2026-106387 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-07T02:00:13Z

Weaknesses