CVE-2026-11272: Chrome iOS Reading List Privilege Escalation Vulnerability

Technical summary

CVE-2026-11272 stems from insufficient validation of untrusted input within Chrome's Reading List component on iOS. The vulnerability exists in Chrome versions prior to 149.0.7827.53. It requires user interaction through specific UI gestures on a crafted HTML page to succeed. The underlying weakness (CWE-20: Improper Input Validation) allows an unauthenticated remote attacker to escape normal security boundaries and obtain elevated privileges. While Chromium's security team classified this as Low severity internally, the CVSS 3.1 score of 8.8 (HIGH) reflects the severity from an impact perspective due to the broad consequences of privilege escalation.

Business impact

Successful exploitation could allow attackers to compromise user credentials, access private browsing data, steal sensitive information stored in Chrome, or manipulate device behavior without authorization. For organizations where employees use Chrome on personal or corporate iOS devices, this increases risk of credential theft, data exfiltration, and potential lateral movement into enterprise networks. The reliance on user interaction slightly limits attack surface, but the ease of social engineering to trigger the required gestures makes this a meaningful risk.

Affected systems

Google Chrome on Apple iOS devices running versions prior to 149.0.7827.53 are vulnerable. This affects both iPhone and iPad users. The vulnerability does not impact Chrome on Android, Windows, macOS, or Linux. Any iOS user running an outdated Chrome build is at risk if they visit a malicious webpage and perform the targeted UI gesture.

Exploitability

Exploitation requires network-level delivery (AV:N) of a crafted HTML page and user interaction (UI:R), but no special privileges or access are needed to launch the attack. The attack complexity is low (AC:L), meaning straightforward social engineering—such as embedding the malicious page in a phishing email or compromised website—can work. The barrier to exploitation is moderate due to the user interaction requirement, but the technique is not technically sophisticated. This vulnerability is not currently tracked in CISA's Known Exploited Vulnerabilities catalog.

Remediation

Organizations should prioritize updating Chrome on all iOS devices to version 149.0.7827.53 or later. Users should enable automatic app updates on their iOS devices to receive patches without manual intervention. Additionally, security awareness training on avoiding suspicious websites and unexpected UI prompts can reduce risk. For managed environments, MDM solutions should enforce minimum Chrome version policies.

Patch guidance

Apply Chrome version 149.0.7827.53 or later on iOS. Users can check their current version via Settings > Apps > Google Chrome > App Version, or enable automatic updates through the App Store's auto-update setting. Organizations managing iOS devices should confirm patch deployment through their MDM console to ensure devices are compliant. Verify patch application within 30 days of release to minimize exposure window.

Detection guidance

Monitor for users visiting suspicious websites that may host exploit payloads, particularly those shared via phishing campaigns. Inspect HTTP/HTTPS logs for requests to known malicious domains. Look for unusual Reading List activity in browser history or unexpected privilege elevation events on iOS devices. Organizations with endpoint detection and response (EDR) solutions on iOS can flag unusual process spawning or capability usage following Chrome activity. However, detection is challenging without behavioral analytics in place; preventive patching remains the primary control.

Why prioritize this

Although not yet in active exploitation according to public records, the combination of high CVSS impact (8.8), low attack complexity, and reliance on a widely-used mobile browser warrants urgent prioritization. Privilege escalation on mobile devices often goes unnoticed by users and can persist across app boundaries. The moderate user-interaction barrier does not significantly reduce risk given the ease of social engineering. Delayed patching leaves organizations vulnerable to targeted campaigns against high-value employees or device compromise in supply-chain attack scenarios.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects full confidentiality, integrity, and availability impact (C:H/I:H/A:H) resulting from privilege escalation on an unauthenticated, network-accessible vector. The network-based delivery (AV:N) and low complexity (AC:L) increase exploitability. Although Chromium internally rated this as Low severity—likely due to the user-interaction requirement and iOS sandbox mitigations—the actual impact of a successful exploit is severe. The HIGH severity classification appropriately prioritizes this above patch-later vulnerabilities and aligns with attack surface and business consequence.

Frequently asked questions