CVE-2026-85047: Improper input validation in Google Chrome

This vulnerability arises from improper input validation within the Transactions Platform component of Google Chrome on iOS versions before 152.0.7977.82. Exploiting this flaw, a remote attacker could craft a malicious HTML page that, when loaded, may execute arbitrary code outside the sandbox environment, compromising the security boundaries of the browser. The CVSS 3.1 base score is 9.6, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and high impact on confidentiality, integrity, and availability. The vulnerability is publicly disclosed with a vendor advisory link but lacks explicit patch or remediation details in the provided data.

Successful exploitation could lead to remote code execution outside the sandbox on affected Chrome versions on iOS, potentially allowing an attacker to fully compromise the browser environment and access sensitive data or perform unauthorized actions. The vulnerability affects confidentiality, integrity, and availability at a high level. No active exploitation has been reported so far.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html for current remediation guidance. Until official fixes are confirmed and applied, users should exercise caution when browsing untrusted content on affected Chrome versions on iOS.