Description
Missing authorization in iOSWebView in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
Published: 2026-10-20
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Potential UI element spoofing via crafted HTML page
Action: Patch Update
AI Analysis

Impact

Missing authorization in the iOSWebView component of Google Chrome for iOS prior to 156.0.8078.47 allows a remote attacker to spoof UI elements via a crafted HTML page. The flaw is an authentication bypass enabling unauthorized UI rendering, and is reflected in the Chromium security severity of Medium.

Affected Systems

Google Chrome for iOS versions prior to 156.0.8078.47 on Apple iPhone OS are affected. Users of these builds should upgrade to the latest stable release which contains a patch for the iOSWebView missing authorization issue.

Risk and Exploitability

The CVSS score of 6.5 indicates medium severity, while the EPSS score of < 1% suggests a very low probability of exploitation. The attack vector is remote, requiring a maliciously crafted HTML page to be rendered by iOSWebView. Because the flaw is an authorization bypass, it allows an attacker to render misleading user interface elements, potentially leading to phishing or user manipulation, though no confirmed exploitation beyond the CVE description has been published.

Generated by OpenCVE AI on November 4, 2026 at 07:52 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Google Chrome on iOS to version 156.0.8078.47 or newer to contain the iOSWebView patch.
  • Enable Chrome's automatic update feature so that future fixes are applied without user intervention.
  • If an update is not immediately possible, avoid loading untrusted web content or consider using an alternative browser that does not expose the same vulnerability until a patch is available.

Generated by OpenCVE AI on November 4, 2026 at 07:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4853-1 chromium security update
Debian DSA Debian DSA DSA-6577-1 chromium security update
History

Wed, 04 Nov 2026 08:15:00 +0000

Type Values Removed Values Added
Title iOSWebView Authorization Bypass in Google Chrome Enables UI Element Spoofing

Wed, 04 Nov 2026 03:15:00 +0000

Type Values Removed Values Added
Title Memory Corruption in iOSWebView Enables Potential Sandbox Memory Disclosure

Tue, 03 Nov 2026 22:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119

Tue, 03 Nov 2026 21:30:00 +0000

Type Values Removed Values Added
Description Memory corruption in iOSWebView in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) Missing authorization in iOSWebView in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-862

Thu, 22 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Title Memory Corruption in iOSWebView Enables Potential Sandbox Memory Disclosure

Thu, 22 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple iphone Os
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:*
Vendors & Products Apple
Apple iphone Os

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 09:00:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Memory corruption in iOSWebView in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-119
References

Subscriptions

Apple Iphone Os
Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-11-03T21:20:52.189Z

Reserved: 2026-10-19T23:12:02.079Z

Link: CVE-2026-113246

cve-icon Vulnrichment

Updated: 2026-10-21T15:11:55.445Z

cve-icon NVD

Status : Modified

Published: 2026-10-20T22:19:18.137

Modified: 2026-11-03T22:18:58.387

Link: CVE-2026-113246

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-04T08:00:09Z

Weaknesses