PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9950 Google CVE debrief

A same-origin policy bypass in Google Chrome on iOS, rated High severity by Chromium but scored LOW (3.1) under CVSS 3.1. The vulnerability stems from insufficient validation of untrusted input in iOS-specific code paths. A remote attacker who has already compromised the renderer process can leverage a crafted HTML page to bypass same-origin protections. The attack requires user interaction (UI:R) and high attack complexity (AC:H), with no availability or integrity impact—only low confidentiality impact. The narrow scope (S:U) and prerequisite renderer compromise significantly constrain practical exploitability. Chrome on iOS versions prior to 148.0.7778.216 are affected; desktop Chrome is not in scope. The CVE was published 2026-05-28 and modified 2026-05-29; it remains Undergoing Analysis in NVD with no KEV listing.

Vendor
Google
Product
Chrome
CVSS
LOW 3.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-07-21
Advisory published
2026-05-28
Advisory updated
2026-07-21

Who should care

Organizations with iOS-managed devices running Chrome; security teams tracking browser-specific SOP bypasses; defenders modeling renderer compromise as part of advanced threat scenarios.

Technical summary

The vulnerability exists in iOS-specific input validation within Google Chrome on iOS. An attacker with renderer process compromise can supply crafted HTML that bypasses same-origin policy checks. The flaw is patched in Chrome iOS 148.0.7778.216. The underlying weakness is categorized as CWE-20 (Improper Input Validation).

Defensive priority

moderate

Recommended defensive actions

  • Update Google Chrome on iOS to version 148.0.7778.216 or later.
  • Monitor for iOS-specific Chrome updates via the App Store, as iOS Chrome uses the WebKit rendering engine and follows a separate release cadence from desktop Chrome.
  • Apply general renderer-hardening practices: site isolation, strict CSP, and reduced attack surface for renderer compromise vectors.
  • Review same-origin policy enforcement in web applications, treating renderer compromise as a plausible threat model for sensitive data exposure on iOS Chrome.

Evidence notes

Chromium security severity (High) diverges from NVD CVSS 3.1 score (3.1 LOW). The CVSS vector AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N reflects the renderer-compromise prerequisite and limited impact. CWE-20 (Improper Input Validation) is cited as secondary by the Chrome CVE admin. No CPE criteria were available in the source record at time of analysis. Vendor attribution to Google is inferred from reference_domain_candidate 'Googleblog' and [email protected] source tags; confidence is low per canonicalSource marking.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-9950 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-9950

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-9950 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-9950

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.