Description
Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
Published: 2026-06-30
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Cross‑origin data leakage
Action: Patch
AI Analysis

Impact

Insufficient validation of untrusted input in Chrome for iOS (CWE‑20) enables a remote attacker to craft a malicious HTML page that, when rendered in the browser, leaks data from another origin. The flaw can result in a confidentiality disclosed across origins may be exposed.

Affected Systems

The vulnerability affects Google Chrome for iOS versions earlier than 150.0.7871.47. Only Chrome for iOS is impacted; the flaw does not apply to other browsers on iOS or to later Chrome releases that incorporate the input‑validation fix.

Risk and Exploitability

The flaw has a CVSS score of 6.5, indicating a medium‑to‑high severity risk, and an EPSS score of <1%, suggesting a very low—and non‑zero—likelihood of exploitation. It is not listed in the CISA KEV catalog. The likely attack vector is a remote attacker delivering a specially crafted HTML page that the user opens in Chrome for iOS; exploitation requires no privileged conditions beyond normal browsing activities.

Generated by OpenCVE AI on July 31, 2026 at 16:25 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Google Chrome for iOS to version 150.0.7871.47 or newer to apply the input‑validation fix.
  • If an update is not immediately possible, avoid opening unknown or suspicious web pages that may contain malicious HTML until the update is installed and apply any subsequent security patches promptly.
  • Use iOS’s built‑in web filtering or a third‑party content‑filtering solution to block potentially malicious sites until the patch is applied.

Generated by OpenCVE AI on July 31, 2026 at 16:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4672-1 chromium security update
Debian DSA Debian DSA DSA-6378-1 chromium security update
History

Fri, 31 Jul 2026 16:45:00 +0000

Type Values Removed Values Added
Title Untrusted Input Can Leak Cross‑Origin Data in Chrome for iOS

Mon, 27 Jul 2026 03:15:00 +0000

Type Values Removed Values Added
Title Untrusted Input Can Leak Cross‑Origin Data in Chrome for iOS

Fri, 24 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Title Cross‑Origin Data Leakage via Insufficient Input Validation in Chrome for iOS

Tue, 21 Jul 2026 17:30:00 +0000

Type Values Removed Values Added
Title Cross‑Origin Data Leakage via Insufficient Input Validation in Chrome for iOS

Thu, 16 Jul 2026 00:45:00 +0000

Type Values Removed Values Added
Title Chrome for iOS Cross‑Origin Data Leakage via Untrusted Input Validation

Tue, 14 Jul 2026 21:15:00 +0000

Type Values Removed Values Added
Title Chrome for iOS Cross‑Origin Data Leakage via Untrusted Input Validation

Mon, 13 Jul 2026 16:45:00 +0000

Type Values Removed Values Added
Title Cross‑origin Data Leakage via Untrusted Input in Chrome for iOS

Sun, 12 Jul 2026 03:15:00 +0000

Type Values Removed Values Added
Title Cross‑origin Data Leakage via Untrusted Input in Chrome for iOS

Sat, 11 Jul 2026 03:00:00 +0000

Type Values Removed Values Added
Title Insufficient Input Validation in Chrome for iOS Enables Cross‑Origin Data Leakage

Thu, 09 Jul 2026 22:15:00 +0000

Type Values Removed Values Added
Title Insufficient Input Validation in Chrome for iOS Enables Cross‑Origin Data Leakage

Wed, 08 Jul 2026 04:00:00 +0000

Type Values Removed Values Added
Title Cross‑Origin Data Leakage via Untrusted Input in Chrome for iOS

Tue, 07 Jul 2026 05:00:00 +0000

Type Values Removed Values Added
Title Cross‑Origin Data Leakage via Untrusted Input in Chrome for iOS

Mon, 06 Jul 2026 12:45:00 +0000

Type Values Removed Values Added
Title Cross‑Origin Data Leak via Unvalidated Input in Chrome for iOS

Sun, 05 Jul 2026 23:30:00 +0000

Type Values Removed Values Added
Title Cross‑Origin Data Leak via Unvalidated Input in Chrome for iOS

Sun, 05 Jul 2026 15:15:00 +0000

Type Values Removed Values Added
Title Chrome for iOS Cross‑Origin Data Leak via Crafted HTML

Sun, 05 Jul 2026 07:30:00 +0000

Type Values Removed Values Added
Title Chrome for iOS Cross‑Origin Data Leak via Crafted HTML

Sat, 04 Jul 2026 20:15:00 +0000

Type Values Removed Values Added
Title Cross‑Origin Data Leakage via Unvalidated Input in Chrome for iOS

Sat, 04 Jul 2026 08:15:00 +0000

Type Values Removed Values Added
Title Cross‑Origin Data Leakage via Unvalidated Input in Chrome for iOS

Sat, 04 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
Title Cross-origin Data Leak via Unvalidated HTML Input in Chrome for iOS

Fri, 03 Jul 2026 09:30:00 +0000

Type Values Removed Values Added
Title Cross-origin Data Leak via Unvalidated HTML Input in Chrome for iOS

Thu, 02 Jul 2026 20:15:00 +0000

Type Values Removed Values Added
Title Cross‑Origin Data Leakage via Unvalidated Input in Chrome for iOS

Thu, 02 Jul 2026 09:30:00 +0000

Type Values Removed Values Added
Title Cross‑Origin Data Leakage via Unvalidated Input in Chrome for iOS

Thu, 02 Jul 2026 02:30:00 +0000

Type Values Removed Values Added
Title Cross‑origin Data Leak via Unvalidated Input in Chrome for iOS

Wed, 01 Jul 2026 18:15:00 +0000

Type Values Removed Values Added
Title Cross‑origin Data Leak via Unvalidated Input in Chrome for iOS

Wed, 01 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 01 Jul 2026 09:15:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Wed, 01 Jul 2026 06:30:00 +0000

Type Values Removed Values Added
Title Remote Cross‑Origin Data Leak via Insufficient Input Validation in Chrome for iOS

Wed, 01 Jul 2026 01:30:00 +0000

Type Values Removed Values Added
Title Remote Cross‑Origin Data Leak via Insufficient Input Validation in Chrome for iOS

Tue, 30 Jun 2026 23:15:00 +0000

Type Values Removed Values Added
Description Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-20
References

Subscriptions

Apple Iphone Os
Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-07-01T19:08:06.540Z

Reserved: 2026-06-29T23:03:32.507Z

Link: CVE-2026-13847

cve-icon Vulnrichment

Updated: 2026-07-01T14:41:58.380Z

cve-icon NVD

Status : Analyzed

Published: 2026-06-30T23:16:59.207

Modified: 2026-10-25T21:10:00.770

Link: CVE-2026-13847

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T16:30:17Z

Weaknesses
  • CWE-20

    Improper Input Validation