CVE-2026-14075: Chrome iOS No-Referrer Policy Bypass

Technical summary

CVE-2026-14075 is an insufficient policy enforcement vulnerability (CWE-602) in Chromium's iOS implementation. The no-referrer policy is a privacy and security control that prevents HTTP Referer headers from being sent in cross-origin requests. The vulnerability allows a remote attacker to circumvent this restriction through a specially crafted HTML page. Affected versions are Chrome for iOS below 150.0.7871.47. The CVSS 3.1 score of 4.3 reflects low attack complexity and no authentication requirement, but limited impact—integrity is compromised (referrer leakage) while confidentiality and availability remain intact.

Business impact

This vulnerability primarily threatens user privacy on iOS devices. Organizations and individuals relying on no-referrer policies to prevent internal URL patterns or referral chains from leaking to external domains face that protection being circumvented. For enterprises, this could expose internal navigation patterns when users interact with malicious third-party content. The impact is limited in scope—it affects referrer header leakage only—but in sensitive workflows (e.g., handling confidential documents where the referrer URL itself may be identifying), the breach of this explicit security boundary warrants attention.

Affected systems

The vulnerability affects Google Chrome on iOS versions prior to 150.0.7871.47. Because Chrome on iOS uses Apple's WebKit engine, the vulnerability is specific to iOS and does not affect Chrome on Android, macOS, Windows, or Linux. Devices running iOS are directly impacted; users on older Chrome versions remain vulnerable until they update.

Exploitability

Exploitability is straightforward. The attack requires network access and user interaction—the victim must visit an attacker-controlled or compromised HTML page. No special privileges or authentication are needed. The barrier is purely social: convincing a user to visit a malicious page. Once there, the browser automatically leaks referrer information in violation of the policy. There is no evidence this vulnerability is exploited in the wild or tracked on the KEV catalog.

Remediation

Chrome for iOS version 150.0.7871.47 and later contain the fix. Users should update their Chrome app from the Apple App Store. Organizations managing iOS devices should ensure device management policies require or encourage prompt updates to Chrome. Because this is a client-side browser vulnerability, network-layer mitigations are limited; focus on end-user patching.

Patch guidance

Update Chrome for iOS to version 150.0.7871.47 or later. On iOS, visit the App Store, search for Google Chrome, and tap Update if available. For organizations, deploy device management policies that enforce or remind users to keep Chrome current. If you maintain a list of approved app versions in your environment, update the minimum version requirement to 150.0.7871.47.

Detection guidance

Detection is primarily behavioral and network-focused. Monitor for anomalous referrer headers in web server logs from iOS clients that should have set no-referrer policies. Web application firewalls may flag unexpected referrer values from iOS Chrome sessions. On the client side, security teams cannot directly detect exploitation within the browser, but user reports of unexpected website activity or privacy concerns may indicate exposure. Consider periodic audits of deployed Chrome versions across managed iOS devices.

Why prioritize this

While the CVSS score is 4.3 (medium), the practical urgency is moderate. The vulnerability is low-severity by Chromium's own assessment, requires user interaction, and is not known to be exploited. However, it directly contradicts an explicit security policy (no-referrer), making it worth prioritizing updates within a normal patch cadence. Organizations with strict privacy requirements or those where referrer URLs carry sensitive information should treat this as higher priority. Standard practice is to patch within 30 days.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects: Attack Vector Network (user visits a page), Attack Complexity Low (no special setup), Privileges Required None, User Interaction Required (user must click/visit), Scope Unchanged (no privilege escalation), Confidentiality Impact None (referrer is not confidential, but its leakage reveals browsing context), Integrity Impact Low (the expected policy is violated, but no data modification occurs), and Availability Impact None. The score appropriately captures a narrow, policy-bypass vulnerability with mild real-world consequences.

Frequently asked questions