PatchSiren cyber security CVE debrief
CVE-2026-9971 Google CVE debrief
A Universal Cross-Site Scripting (UXSS) vulnerability in Google Chrome on iOS, fixed in version 148.0.7778.216, allows remote attackers to inject arbitrary scripts or HTML after convincing a user to perform specific UI gestures. The vulnerability stems from an inappropriate implementation in iOS and carries a High severity rating per Chromium. The CVSS 3.1 score of 5.4 (MEDIUM) reflects network attack vector, low attack complexity, no privileges required, user interaction required, and low impacts to confidentiality and integrity with no availability impact. The issue was published to CVE on May 28, 2026, and modified on May 29, 2026, with NVD status currently Undergoing Analysis. No known exploitation in ransomware campaigns or KEV listing is present.
- Vendor
- Product
- Chrome
- CVSS
- MEDIUM 5.4
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-28
- Original CVE updated
- 2026-05-29
- Advisory published
- 2026-05-28
- Advisory updated
- 2026-05-29
Who should care
Organizations with iOS device fleets using Google Chrome, mobile security teams, enterprise mobility administrators, and security awareness training programs focused on phishing and social engineering defenses.
Technical summary
CVE-2026-9971 is an inappropriate implementation vulnerability in the iOS version of Google Chrome that enables Universal Cross-Site Scripting (UXSS). Unlike standard XSS that exploits a specific vulnerable website, UXSS can inject malicious scripts into arbitrary domains, bypassing same-origin protections. The attack requires remote delivery of a crafted HTML page combined with social engineering to induce specific user UI gestures. The fix was released in Chrome for iOS stable version 148.0.7778.216. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).
Defensive priority
medium
Recommended defensive actions
- Update Google Chrome on iOS to version 148.0.7778.216 or later as soon as available through the App Store.
- Advise users to exercise caution with unexpected web pages that prompt for unusual UI gestures or interactions.
- Monitor for iOS Chrome updates via enterprise mobile device management policies to ensure rapid deployment.
- Review web content filtering and phishing defenses to reduce likelihood of users encountering crafted HTML pages designed to exploit this vulnerability.
- Track NVD analysis status for potential CVSS or severity revisions as evaluation completes.
Evidence notes
CVE description confirms UXSS via crafted HTML page requiring user UI gestures. CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N supports medium severity. Chromium issue tracker reference provides technical provenance. Chrome Releases blog reference provides patch confirmation for stable channel.
Official resources
2026-05-28T23:16:55.310Z