Incorrect authorization in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to… (CVE-2026-106397)

CVE-2026-106397 is an incorrect authorization vulnerability in Google Chrome on iOS before version 155.0.8059.39. This flaw enables a remote attacker to bypass system access restrictions by leveraging social engineering techniques and delivering a crafted HTML page. The vulnerability is classified under CWE-863 (Incorrect Authorization). The CVSS v3.1 base score is 6.1, indicating medium severity, with attack vector network, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality and integrity but not availability.

Successful exploitation allows a remote attacker to bypass system access restrictions on affected versions of Google Chrome on iOS, potentially leading to unauthorized access to restricted system resources or data. The impact affects confidentiality and integrity but does not affect availability. There are no known exploits in the wild at this time.

A fix is available in Google Chrome for iOS version 155.0.8059.39 and later. Users and administrators should update to this version or later to remediate the vulnerability. No additional mitigation guidance is provided or required beyond applying the official update.