CVE-2026-9950
Google Chrome on iOS Input Validation Flaw Allows Same Origin Policy Bypass
Publication date: 2026-05-28
Last updated on: 2026-05-28
Assigner: Chrome
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| chrome | to 148.0.7778.216 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-20 | The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves insufficient validation of untrusted input in Google Chrome on iOS versions prior to 148.0.7778.216. Specifically, a remote attacker who has compromised the renderer process can bypass the same origin policy by using a specially crafted HTML page.
How can this vulnerability impact me? :
The vulnerability allows an attacker to bypass the same origin policy, which is a critical security mechanism that restricts how documents or scripts loaded from one origin can interact with resources from another origin. By bypassing this policy, an attacker could potentially access sensitive information or perform unauthorized actions within the browser context.