CVE-2026-106351: Observable discrepancy in Google Chrome

This vulnerability in Google Chrome on iOS versions before 155.0.8059.39 allows a remote attacker with control over the renderer process to exploit an observable discrepancy in the Safe Browsing component. By crafting a malicious HTML page, the attacker can extract sensitive information. The CVSS v3.1 base score is 5.3 (medium), reflecting network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, and high confidentiality impact. The vendor has released a stable channel update addressing this issue.

An attacker who has compromised the renderer process can leverage this vulnerability to obtain sensitive information from the browser environment. There is no impact on integrity or availability. The vulnerability requires user interaction and has a high attack complexity, limiting exploitability. No known exploits are reported in the wild at this time.

A stable channel update for Google Chrome on iOS version 155.0.8059.39 or later addresses this vulnerability. Users and administrators should apply this update promptly to remediate the issue. No additional mitigation steps are indicated by the vendor advisory.