# CVE-2026-85047: Google Chrome improper input validation in Transactions Platform on iOS

Source: https://junglewise.ai/threats/cve-2026-85047-google-chrome-improper-input-validation-in-transactions-platform  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-85047 · Severity: critical · CVSS 9.6 · Published 2026-09-03

Google Chrome on iOS contains a flaw in its Transactions Platform component that fails to properly validate user-supplied input. An attacker could exploit this vulnerability by sending a specially crafted webpage to a user, potentially executing malicious code outside the browser's security sandbox and compromising the device. This could lead to unauthorized access to sensitive data or control of the device.

Technologies: [Apple Iphone Os](https://junglewise.ai/threats/technologies/iphone-os), [Google Chrome](https://junglewise.ai/threats/technologies/chrome). Vendors: [Apple](https://junglewise.ai/threats/vendors/apple), [Google](https://junglewise.ai/threats/vendors/google).

## Quick answers

**Is CVE-2026-85047 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85047 being exploited in the wild.

**How severe is CVE-2026-85047?** Critical severity, with a CVSS score of 9.6, published 3 September 2026.

**Which products and versions are affected?** Google Chrome prior to 152.0.7977.82 on iOS.

**Is there a fix for CVE-2026-85047?** A patch was published on 2026-09-03: Fixed in Chrome 152.0.7977.82 for iOS Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-85047 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-85047?** Check whether you run Apple Iphone Os or Google Chrome at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A improper input validation vulnerability exists in the Transactions Platform component of Google Chrome on iOS prior to version 152.0.7977.82. The vulnerability allows a remote attacker to execute arbitrary code outside the browser sandbox by crafting a malicious HTML page. The attack requires user interaction (visiting a malicious website) but does not require authentication. An attacker could achieve sandbox escape and arbitrary code execution on the affected iOS device. The vulnerability has been patched in Chrome version 152.0.7977.82 and later.

## Affected products

- Google Chrome prior to 152.0.7977.82 on iOS

## Timeline

- 2026-09-03: disclosed: Published in Chrome security update
- 2026-09-03: patched: Fixed in Chrome 152.0.7977.82 for iOS

## References

- [https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html](https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html)
- [https://issues.chromium.org/issues/513790581](https://issues.chromium.org/issues/513790581)

## Related threats

- [Google Chrome out of bounds read in Skia](https://junglewise.ai/threats/cve-2026-126922-out-of-bounds-read-in-skia-in-google-chrome-prior-to-157-0-8103)
- [Google Chrome use after free in Accessibility](https://junglewise.ai/threats/cve-2026-126921-use-after-free-in-accessibility-in-google-chrome-prior-to-157-0)
- [Google Chrome information leak in Skia](https://junglewise.ai/threats/cve-2026-126920-information-leak-in-skia-in-google-chrome-prior-to-157-0-8103-78)
- [Google Chrome use-after-free in BrowserTag](https://junglewise.ai/threats/cve-2026-126919-use-after-free-in-browsertag-in-google-chrome-prior-to-157-0)
- [Google Chrome use-after-free in Layout](https://junglewise.ai/threats/cve-2026-126918-use-after-free-in-layout-in-google-chrome-prior-to-157-0-8103-78)