Description
Incorrect authorization in Mobile in Google Chrome on on iOS prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
Published: 2026-08-25
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation through Bypassed System Access Restrictions
Action: Patch
AI Analysis

Impact

An incorrect authorization check in Chrome Mobile on iOS versions before 152.0.7977.65 allows a remote attacker to load a specially crafted HTML page that bypasses a system access restriction. This vulnerability can grant the attacker elevated local privileges or allow access to normally protected resources, violating confidentiality and integrity. The weakness is identified as an authorization flaw (CWE-863).

Affected Systems

Google Chrome for iOS versions earlier than 152.0.7977.65 are affected. The vulnerability applies to all devices running those versions of the Chrome Mobile app on iOS.

Risk and Exploitability

The Chromium security team rates the severity as Medium with a CVSS score of 4.3, and the issue is not yet listed in the CISA KEV catalog. The EPSS score of < 1% indicates a very low but non‑zero exploitation probability. The vulnerability is reachable via a remote crafted webpage, and organizations using affected Chrome iOS versions face a moderate risk of unauthorized access if users visit malicious or unsuspected sites.

Generated by OpenCVE AI on August 28, 2026 at 22:51 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Chrome on iOS to version 152.0.7977.65 or later, ensuring the authorization fix is applied.
  • Configure Chrome’s safety features such as Safe Browsing, and disable any non-essential file‑system access settings to reduce the attack surface.
  • Monitor mobile device logs for unusual privilege escalation or unauthorized file access activity.

Generated by OpenCVE AI on August 28, 2026 at 22:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4771-1 chromium security update
Debian DSA Debian DSA DSA-6482-1 chromium security update
History

Mon, 31 Aug 2026 14:30:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple iphone Os
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:*
Vendors & Products Apple
Apple iphone Os

Fri, 28 Aug 2026 23:15:00 +0000

Type Values Removed Values Added
Title Unauthorized Bypass of System Access Restrictions in Chrome Mobile iOS via Crafted HTML

Fri, 28 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'}

Wed, 26 Aug 2026 04:00:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Wed, 26 Aug 2026 00:45:00 +0000

Type Values Removed Values Added
Title Unauthorized Bypass of System Access Restrictions in Chrome Mobile iOS via Crafted HTML

Tue, 25 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Description Incorrect authorization in Mobile in Google Chrome on on iOS prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-863
References

Subscriptions

Apple Iphone Os
Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-08-28T18:46:00.729Z

Reserved: 2026-08-25T06:11:48.851Z

Link: CVE-2026-79217

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2026-08-25T21:18:15.760

Modified: 2026-08-31T14:12:05.630

Link: CVE-2026-79217

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T23:00:14Z

Weaknesses