CVE-2026-9950: Same-Origin Policy Bypass in Chrome on iOS – Patch Now

Technical summary

CVE-2026-9950 is a CWE-20 input validation weakness affecting the iOS variant of Google Chrome. The vulnerability allows bypass of the same-origin policy (SOP)—a fundamental browser security mechanism that prevents scripts from one origin from accessing resources on another origin. The attack requires two conditions: (1) prior compromise of the Chrome renderer process, and (2) user interaction with a crafted HTML page. Under these conditions, an attacker can cross origin boundaries to read non-sensitive data. The Chromium project assigned this a High security severity classification, though the resulting CVSS 3.1 score of 3.1 reflects the high bar for exploitation.

Business impact

While the CVSS score is low, the business context warrants attention. A successful attack requires renderer compromise first, limiting immediate real-world risk. However, if an attacker has already broken into Chrome's sandbox, this vulnerability could enable them to exfiltrate data from multiple origins—potentially accessing credentials, session tokens, or user-specific information across multiple websites. For organizations with users on iOS devices accessing sensitive web applications, this represents a secondary risk multiplier in a chain attack scenario.

Affected systems

Google Chrome on iOS running any version prior to 148.0.7778.216 is affected. The vulnerability is specific to iOS and does not apply to Chrome on Android, macOS, Windows, Linux, or Chrome OS. Organizations should verify the exact Chrome versions deployed to their iOS user base, particularly in BYOD environments or managed device scenarios where iOS is prevalent.

Exploitability

Exploitation has a high bar. An attacker must: (1) first compromise the Chrome renderer process through a separate vulnerability or attack, (2) convince a user to visit a crafted HTML page, and (3) have the victim interact with that page (the UI requirement is part of the CVSS calculation). The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating no widespread active exploitation has been documented at the time of publication. The attack surface is narrower than a direct browser vulnerability, but should not be dismissed in threat modeling for organizations facing sophisticated adversaries.

Remediation

Update Google Chrome on iOS to version 148.0.7778.216 or later. Users can check their current version in Chrome settings (Menu > About Chrome) and apply updates through the iOS App Store. Organizations managing iOS devices through MDM solutions should push this update via their deployment channels. No workarounds exist; patching is the definitive remediation.

Patch guidance

For individual users: navigate to the iOS App Store, search for 'Google Chrome,' and tap Update if available. The patch will download and install automatically when you next open Chrome or manually if you select Install Now. For IT teams: deploy Chrome version 148.0.7778.216 or later through your mobile device management (MDM) solution. Verify deployment within 7–14 days. If your organization uses profile-based app version pinning, adjust policies to allow version 148.0.7778.216 or accept automatic updates. Test the patch in a pilot group before organization-wide rollout to ensure compatibility with critical web applications.

Detection guidance

Monitor Chrome version strings in your device inventory or MDM console for any instances running pre-148.0.7778.216. Check iOS App Store update logs and device compliance reports. Network-level detection is difficult without browser instrumentation; focus on inventory and asset management. If you suspect a renderer process compromise (unusual crashes, unexpected data access), isolate the device and review application logs. Endpoint detection and response (EDR) tools may flag unusual memory access patterns if the vulnerability is exploited in combination with a renderer compromise vector.

Why prioritize this

This vulnerability merits medium priority despite its low CVSS score. The reason: same-origin policy is a critical security pillar, and any bypass—even one requiring prior compromise—increases the blast radius of a successful renderer exploit. Organizations heavy on iOS and web-based SaaS should prioritize patching sooner. However, the high bar for exploitation (two-stage attack) and absence of public exploits mean this is not an emergency patch for all users; staged deployment over 2–3 weeks is reasonable.

Risk score, explained

The CVSS 3.1 score of 3.1 (Low) reflects a narrow attack vector: Network-based delivery, but requiring both High complexity (prior renderer compromise), No privileges, and User interaction. Confidentiality impact is Low (non-sensitive data only), with no integrity or availability impact. The score undersells the security principle at stake (SOP bypass) but accurately reflects real-world exploitability constraints. Organizations should weigh this against their threat model: if you face advanced adversaries capable of chaining vulnerabilities, the effective risk is higher than the score suggests.

Frequently asked questions