Executive brief
Google Chrome for iOS is a popular mobile web browser. A security flaw in the browser's implementation could allow a malicious website to bypass the Same Origin Policy, which is a fundamental security boundary that prevents websites from accessing each other's data. In practice, this could allow an attacker to potentially view information from other open tabs or websites that the user is currently logged into.
Technical details
An inappropriate implementation in Chrome for iOS prior to version 149.0.7827.53 allowed a remote attacker to bypass the Same Origin Policy (SOP). The vulnerability is triggered when a user visits a specially crafted HTML page controlled by the attacker. By bypassing SOP, the attacker could potentially access sensitive data from other origins in the browser context. Google has addressed this issue in the stable channel update for iOS. Chromium developers classified this with a 'Low' security severity.
Affected products
- Google Chrome for iOS prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome 149.0.7827.53 released for stable channel
- 2026-06-05: disclosed: CVE published to NVD