Improper input validation in Transactions Platform in Google Chrome on on iOS prior to 152.0.7977.82 allowed a remote attacker to potentially… (CVE-2026-85047)

CVE-2026-85047 describes an improper input validation vulnerability in the Transactions Platform of Google Chrome on iOS before version 152.0.7977.82. This vulnerability enables a remote attacker to potentially execute arbitrary code outside the browser sandbox via a specially crafted HTML page. The CVSS v3.1 score is 9.6 (critical), indicating network attack vector, low complexity, no privileges required, user interaction needed, scope changed, and high impact on confidentiality, integrity, and availability. There is no explicit patch link provided, but the vulnerability affects versions prior to 152.0.7977.82, implying that the fixed version is 152.0.7977.82 or later.

Successful exploitation allows remote code execution outside the sandbox, compromising the confidentiality, integrity, and availability of the affected system. This could lead to full system compromise on the affected iOS device running Google Chrome versions prior to 152.0.7977.82.

Upgrade Google Chrome on iOS to version 152.0.7977.82 or later to remediate this vulnerability. Since no official patch link is provided, users should verify the update availability directly from Google Chrome's official update channels. No other mitigations are specified.