CVE-2026-10950: Chrome iOS Autofill Data Leak Vulnerability – Patch Guide

Technical summary

CVE-2026-10950 involves insufficient policy enforcement in Chrome's autofill mechanism on iOS. The vulnerability stems from inadequate isolation of autofill data across security boundaries, categorized under CWE-693 (Improper Control of Dynamically-Managed Code Resources). An attacker-controlled webpage can extract autofill information—such as saved credentials, form data, or other sensitive fields—from cross-origin contexts where that data should be restricted. The flaw is triggered through crafted HTML and exploited with network-level access; no local privilege or prior compromise is required. Chromium's internal security assessment rated this as High severity.

Business impact

The leakage of cross-origin autofill data creates a credential and personal information exposure risk. Users may have payment details, usernames, email addresses, or other sensitive autofill entries stolen without their knowledge. For enterprises managing iOS devices and relying on Chrome for work tasks, this could enable phishing follow-ups, account takeover chains, or theft of corporate data inadvertently stored in autofill. The requirement for user interaction limits the attack surface to scenarios where users visit untrusted sites, but the prevalence of social engineering makes this a realistic threat vector.

Affected systems

All iOS users running Google Chrome versions prior to 149.0.7827.53 are affected. The vulnerability does not impact Chrome on Android, macOS, Windows, Linux, or other platforms—it is specific to the iOS implementation. Any iPhone or iPad user with an older Chrome version installed is susceptible if they visit a crafted malicious webpage.

Exploitability

Exploitability is moderate. An attacker must host a malicious webpage and convince or trick a user into visiting it (via phishing, ads, or social engineering). The attack surface is broad because users often click links in emails, messages, or social media without verification. However, the attack does not work against a user who never visits untrusted sites or who restricts Chrome use. No special network position, user privileges, or advanced technical setup is required on the attacker side. The CVSS 3.1 score of 6.5 (MEDIUM) reflects this balance: high confidentiality impact and low attack complexity, but mandatory user interaction.

Remediation

Users should update Google Chrome on iOS to version 149.0.7827.53 or later. iPhone and iPad owners can do this through the App Store by opening the Updates tab, finding Chrome, and installing the latest version if not already automatic. Enterprise administrators managing iOS devices through MDM solutions should push Chrome updates as a priority and verify deployment completion. Users concerned about autofill security can also disable autofill in Chrome settings (Settings > Passwords and security > Autofill) as a temporary measure, though this reduces usability.

Patch guidance

Google has released the fix in Chrome 149.0.7827.53 for iOS. Users should check the App Store for the latest version; most modern iOS setups have automatic app updates enabled by default. Administrators should verify that managed devices are running this version or later through their MDM console. No workarounds or interim mitigations from Google have been published; patching is the primary remediation. Users on older iOS versions that no longer receive Chrome updates should consider upgrading their device OS if possible.

Detection guidance

Detecting exploitation in real-time is difficult because the attack leverages normal browser behavior (autofill) and standard HTML rendering. Organizations can monitor for suspicious redirect chains, unusual cross-origin data exfiltration attempts, or user reports of unexpected credential compromises after visiting certain sites. Endpoint detection and response (EDR) tools may flag unusual subprocess spawning or data access patterns if autofill data is being extracted programmatically. Security teams should also track Chrome version inventory on managed iOS devices to identify endpoints still running vulnerable versions. User education about phishing and untrusted sites remains a key preventive control.

Why prioritize this

Although this vulnerability carries a MEDIUM CVSS score and is not listed on CISA's Known Exploited Vulnerabilities catalog, it merits timely patching because it directly threatens user credentials and personal data. The ease of user-level exploitation (a simple visit to a malicious site) and the broad user base of Chrome on iOS make this a practical risk. Organizations with iOS device fleets or BYOD policies should treat this as a standard-priority update, not an emergency, but should not delay—many users will not self-update promptly without nudging.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects a Medium severity rating based on: Attack Vector Network (the flaw is remotely exploitable), Attack Complexity Low (no special conditions needed beyond the malicious page), Privileges Required None (no prior access needed), User Interaction Required (user must visit the site), Scope Unchanged (impact is limited to the affected user's confidentiality, not system integrity or availability), Confidentiality Impact High (autofill data is fully disclosed), Integrity Impact None (no data modification), and Availability Impact None (no denial of service). The gap between Chromium's internal High rating and the CVSS Medium reflects Chromium's use of a different methodology; CVSS is conservative about availability and integrity, whereas Chromium may weigh credential exposure more heavily.

Frequently asked questions