CVE-2026-106353: Improper input validation in Google Chrome

CVE-2026-106353 is an improper input validation vulnerability in Google Chrome Mobile on iOS before version 155.0.8059.39. The issue allows a remote attacker leveraging social engineering and a co-installed app to bypass the web origin policy, potentially enabling unauthorized access to web content. The Chromium security team has assigned a low severity rating to this vulnerability. The vendor advisory is available but does not explicitly state patch status or remediation details in the provided data.

The vulnerability could allow a remote attacker, via social engineering and a co-installed app, to bypass the web origin policy in Chrome Mobile on iOS. This could lead to unauthorized access to web content that should be isolated by origin policy. However, the impact is considered low severity by the Chromium security team, indicating limited risk or difficulty of exploitation.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html for current remediation guidance. Users should update Chrome Mobile on iOS to version 155.0.8059.39 or later once available to address this issue.