CVE-2026-10944: Chrome iOS Autofill Data Leak Vulnerability – Patch Now

Technical summary

CVE-2026-10944 stems from insufficient policy enforcement in Chrome's autofill mechanism on iOS. The vulnerability permits a remote attacker to exfiltrate cross-origin data through a specially crafted HTML page. The flaw allows data that should remain isolated to a particular website to be accessed and leaked to an attacker-controlled origin. The issue affects Chrome versions prior to 149.0.7827.53 and is classified under CWE-693 (Improper Restriction of Rendered UI Layers or Frames). Chromium's security team rated this as High severity due to the confidentiality impact and low attack complexity.

Business impact

The primary business risk is credential and payment data exposure. Users who rely on Chrome's autofill to manage credentials across multiple sites face potential account compromise if they visit a malicious page. For organizations whose employees use Chrome on iOS devices for work—particularly those handling customer or internal data—this vulnerability could lead to unauthorized data access, compliance violations, and user trust erosion. The low barrier to exploitation (a simple webpage visit) amplifies the risk profile relative to more complex attack chains.

Affected systems

This vulnerability affects Google Chrome on Apple iOS running versions prior to 149.0.7827.53. It does not impact Chrome on Android, desktop platforms, or other browsers. Affected users are those running older builds of Chrome iOS and visiting untrusted web content. Organizations with iOS-based workforces using Chrome for web applications should prioritize assessment of their deployment versions.

Exploitability

Exploitability is moderate to high in practice. An attacker needs only to craft a malicious HTML page and convince a user to visit it—no network position or elevated privileges required. The attack surface is anyone with Chrome on iOS, making it accessible to opportunistic attackers. However, the vulnerability does require user interaction (clicking a link or visiting the page), which serves as a minor friction point. No public exploit or active in-the-wild campaigns are currently tracked in the Known Exploited Vulnerabilities (KEV) catalog, but the simplicity of the attack vector and the sensitivity of autofill data suggest this could attract attention.

Remediation

Update Google Chrome on iOS to version 149.0.7827.53 or later as soon as possible. Users should verify their current version in Chrome settings (tap your profile icon > Settings > About Chrome) and enable automatic updates. Additionally, consider reviewing and clearing sensitive autofill data (Settings > Autofill and passwords) if you suspect a visit to an untrusted site occurred. For organizations, enforce Chrome version pinning or managed updates via Mobile Device Management (MDM) if available.

Patch guidance

Google has released Chrome 149.0.7827.53 as the fix version. Deployment should prioritize affected iOS devices and users. Because iOS app updates flow through the App Store, users must either enable automatic updates in the App Store settings or manually update the app. Organizations using MDM solutions can leverage managed Chrome deployment to enforce rapid updates. Verify that all Chrome instances on iOS devices are updated; note that some enterprise environments may have deployment delays due to App Store review processes or internal testing procedures.

Detection guidance

Monitor for successful autofill data extraction by examining network logs for unusual cross-origin requests originating from autofill interactions. Endpoint Detection and Response (EDR) on managed iOS devices may flag suspicious data exfiltration patterns. On the application side, review web server logs for atypical access patterns to autofill-sensitive endpoints. Users should monitor linked accounts (email, payment services, etc.) for unauthorized access attempts. If an organization suspects compromise via this vector, credential reset and account activity review are advisable for affected users.

Why prioritize this

Despite a CVSS score of 6.5 (MEDIUM), this vulnerability warrants high-priority attention due to the nature of autofill data (credentials, payment information) and the low attack friction. The vulnerability is not yet tracked in the KEV catalog but poses direct risk to user authentication and financial data. The ease of user-to-attack-surface connection (simply visiting a webpage) and the iOS platform's prevalent use in mobile workforces elevate business risk above the numeric severity alone.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects a medium severity rating driven by high confidentiality impact (C:H), network-based attack vector (AV:N), and low attack complexity (AC:L). However, the score is tempered by the requirement for user interaction (UI:R) and no impact on integrity or availability. While the numeric score is moderate, the real-world business impact—potential compromise of stored credentials and payment data—often justifies faster response than the CVSS alone suggests. Organizations should weigh the sensitivity of data their users autofill when determining response urgency.

Frequently asked questions