CVE-2026-9950
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
Insufficient validation of untrusted input in Google Chrome on iOS prior to 148.0.7778.216 allows a remote attacker who has compromised the renderer process to bypass same origin policy via a crafted HTML page. This vulnerability is rated as High severity by Chromium.
Risk Assessment
The risk involves bypassing same-origin policy, potentially leading to data theft or session hijacking. Although the attack requires prior compromise of the renderer process, it is considered high risk.
Recommendation
Immediately update Google Chrome on iOS to version 148.0.7778.216 or later. Consider implementing additional security measures such as Content Security Policy.
Original NVD description (English source)
Insufficient validation of untrusted input in iOS in Google Chrome on iOS prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: High)