This vulnerability (CVE-2026-17960) affects Google Chrome on iOS versions before 151.0.7922.72. It is caused by insufficient policy enforcement related to the no-referrer policy, which can be bypassed by a remote attacker using a specially crafted HTML page. The vulnerability is classified under CWE-602 (Improper Restriction of XML External Entity Reference). The CVSS 3.1 base score is 4.3, indicating medium severity, with an attack vector of network, low attack complexity, no privileges required, user interaction required, and impact limited to integrity. The vendor advisory linked does not explicitly confirm patch availability or remediation level.

The vulnerability allows a remote attacker to bypass the no-referrer policy in affected versions of Chrome for iOS, potentially leading to unintended information disclosure about the referring page. However, the impact is limited to integrity and does not affect confidentiality or availability. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The linked Google Chrome stable channel update blog post should be monitored for updates regarding fixes. Until an official fix is confirmed, users should exercise caution when browsing untrusted content on affected Chrome for iOS versions.