PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9971 Google CVE debrief

A Universal Cross-Site Scripting (UXSS) vulnerability in Google Chrome on iOS, fixed in version 148.0.7778.216, allows remote attackers to inject arbitrary scripts or HTML after convincing a user to perform specific UI gestures. The vulnerability stems from an inappropriate implementation in iOS and carries a High severity rating per Chromium. The CVSS 3.1 score of 5.4 (MEDIUM) reflects network attack vector, low attack complexity, no privileges required, user interaction required, and low impacts to confidentiality and integrity with no availability impact. The issue was published to CVE on May 28, 2026, and modified on May 29, 2026, with NVD status currently Undergoing Analysis. No known exploitation in ransomware campaigns or KEV listing is present.

Vendor
Google
Product
Chrome
CVSS
MEDIUM 5.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-05-29
Advisory published
2026-05-28
Advisory updated
2026-05-29

Who should care

Organizations with iOS device fleets using Google Chrome, mobile security teams, enterprise mobility administrators, and security awareness training programs focused on phishing and social engineering defenses.

Technical summary

CVE-2026-9971 is an inappropriate implementation vulnerability in the iOS version of Google Chrome that enables Universal Cross-Site Scripting (UXSS). Unlike standard XSS that exploits a specific vulnerable website, UXSS can inject malicious scripts into arbitrary domains, bypassing same-origin protections. The attack requires remote delivery of a crafted HTML page combined with social engineering to induce specific user UI gestures. The fix was released in Chrome for iOS stable version 148.0.7778.216. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Defensive priority

medium

Recommended defensive actions

  • Update Google Chrome on iOS to version 148.0.7778.216 or later as soon as available through the App Store.
  • Advise users to exercise caution with unexpected web pages that prompt for unusual UI gestures or interactions.
  • Monitor for iOS Chrome updates via enterprise mobile device management policies to ensure rapid deployment.
  • Review web content filtering and phishing defenses to reduce likelihood of users encountering crafted HTML pages designed to exploit this vulnerability.
  • Track NVD analysis status for potential CVSS or severity revisions as evaluation completes.

Evidence notes

CVE description confirms UXSS via crafted HTML page requiring user UI gestures. CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N supports medium severity. Chromium issue tracker reference provides technical provenance. Chrome Releases blog reference provides patch confirmation for stable channel.

Official resources

2026-05-28T23:16:55.310Z