CVE-2026-106189

Executive Summary

CVE-2026-106189 is a code injection vulnerability (CWE-94) in the ReaderMode component of Google Chrome on iOS that affects versions prior to 155.0.8059.39. A remote attacker can exploit the flaw by convincing a victim to open a crafted HTML page, allowing the attacker to bypass web origin policy. The issue carries a Chromium security severity of Medium and is classified as UNPATCHED in this dataset (patch confidence 0/4), meaning no verified patch evidence, workarounds, or vendor fix references were captured from tracked sources.

Technical Analysis

ReaderMode is a Chrome feature that extracts the primary readable content from a web page and re-renders it in a simplified, distraction-reduced view. In the iOS implementation, ReaderMode processes attacker-influenceable HTML content — parsed from a page the user chooses to visit — and re-presents it inside a reader context. The NVD description states the root cause as code injection within ReaderMode, with the outcome that web origin policy can be bypassed via a crafted HTML page.

Because the flaw class is CWE-94 (Improper Control of Generation of Code / "Code Injection"), the security-relevant failure is that attacker-controlled input is not adequately neutralized before it influences code or content-execution behavior in the ReaderMode rendering path. The precise injection sink (for example, whether content is injected into the reader container, into a scripting context, or into a navigation target) is not described in the supplied data, and no function names, DOM APIs, file paths, or IPC interfaces are named in the NVD description or CNA title. Analysts should therefore treat the specific injection point as unknown and rely on the reported impact: origin-policy bypass.

Origin policy (the Same-Origin Policy) is the core isolation boundary in web browsers; it restricts how documents and scripts from one origin can read or interact with resources from another. When a bypass occurs, the injected code is able to interact with content or privileges that should have been restricted to a different origin. In a mobile Chrome reader context, such a bypass can enable cross-origin data access or interaction between the reader-generated document and the originally loaded page or its content. The Chromium security severity of Medium indicates the project judged the impact meaningful but constrained — typically requiring user interaction (the victim opening a crafted page) and not granting immediate full code execution outside the browser sandbox.

Attack surface: the vulnerable component is client-side and remote-triggerable but requires the victim to navigate to attacker-supplied HTML. No authentication or privileged network position is required. Exploitation is delivered over the web via social engineering. CVSS is not published by NVD (N/A) and no EPSS score exists; any severity metric in this report is clearly marked as an analyst estimate.

Exploitation Scenarios

Note: No public PoC or exploit code is available for this CVE. The following attack chain is described at the vulnerability-class level and does not assert implementation details beyond what the NVD description supports.

1. Reconnaissance / target identification. The attacker identifies that the victim uses Chrome on iOS at a version below 155.0.8059.39. Because this is a mobile client, reconnaissance focuses on user targeting (device type, browser, iOS) rather than service enumeration; there is no server-side component to fingerprint via Shodan. Delivery is user-driven.

2. Triggering the flaw class. Using social engineering, the attacker directs the victim to open a crafted HTML page (e.g., via messaging, email, QR code, or malicious advertisement). When the page is processed by ReaderMode on an affected Chrome for iOS build, attacker-controlled content reaches the ReaderMode rendering path without sufficient neutralization, constituting the code injection.

3. Payload / execution method (class level). The injection results in a bypass of web origin policy. At the class level, the injected content causes the browser to treat attacker-influenced material as if it originated from or is permitted to interact with a different origin than intended. The specific payload mechanism is not documented in the available data and is not fabricated here.

4. Post-exploitation impact. The origin-policy bypass allows the attacker to interact with or read content that the Same-Origin Policy should have isolated. The Medium severity rating implies the practical impact is bounded (e.g., cross-origin data exposure or interaction within the reader/browser context) rather than full device compromise. No privilege escalation to the OS or sandbox escape is claimed by the source data.

Impact Assessment

Business impact is concentrated in the mobile browser estate: any organization whose workforce uses iPhones or iPads with Chrome for iOS below 155.0.8059.39 is potentially in scope. Because the vector is remote, unauthenticated, and delivered through a crafted web page combined with social engineering, the primary exposure is phishing-driven: users who click attacker links become the attack path. The blast radius per device is a bypass of the browser's origin-isolation boundary, which can undermine the web security model relied upon by all web applications the user accesses within that browser session.

CVSS is not published by NVD; the analyst estimate shown in METADATA (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) reflects network reachability, low attack complexity, no privileges, required user interaction, and a scope change (origin boundary crossed) with low confidentiality and integrity impact — consistent with a Medium-rated origin-policy bypass. This estimate is not authoritative and should not be cited as a vendor score. EPSS is not yet scored by FIRST.org; no exploitation-likelihood probability should be inferred.

Detection Guidance

Sigma Rule

title: Chrome iOS ReaderMode Origin Policy Bypass Attempt (CVE-2026-106189)
id: 6f2b9c14-8a3d-4e21-9c7f-1d4a5b6e7c88
status: experimental
description: Detects browser activity consistent with the Chrome on iOS ReaderMode code injection / origin-policy bypass, based on user-agent and reader activation indicators.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-106189
author: valtersit.com
date: 2026-01-01
logsource:
  category: proxy
  product: any
detection:
  selection_ua:
    c-useragent|contains: 'CriOS/'
  selection_ios:
    c-useragent|contains: 'iPhone'
  selection_reader:
    cs-uri|contains: 'reader'
  condition: selection_ua and selection_ios and selection_reader
fields:
  - c-ip
  - cs-uri
  - c-useragent
falsepositives:
  - Legitimate use of Reader Mode by users on non-vulnerable builds
level: low
tags:
  - attack.t1189
  - cve.2026-106189

YARA Rule

rule CVE_2026_106189_Chrome_iOS_ReaderMode_Injection
{
    meta:
        description = "Detects HTML content crafted to target Chrome on iOS ReaderMode origin policy bypass (heuristic; no verified PoC exists)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-106189"
        date = "2026-01-01"
        severity = "medium"
        confidence = "low"

    strings:
        $reader = "readermode" nocase
        $rdr    = "reader-mode" nocase
        $iframe = "<iframe" nocase
        $srcdoc = "srcdoc" nocase
        $origin = "document.domain" nocase
        $postmsg = "postMessage" nocase

    condition:
        filesize < 2MB and
        ($reader or $rdr) and
        2 of ($iframe, $srcdoc, $origin, $postmsg)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-106189 Chrome iOS ReaderMode crafted HTML delivery (heuristic)"; flow:established,to_client; http.user_agent; content:"CriOS/"; http.user_agent; content:"iPhone"; content:"reader-mode"; nocase; http.response_body; content:"<iframe"; nocase; threshold:type limit, track by_src, count 1, seconds 60; classtype:attempted-user; sid:2026106189; rev:1; metadata:cve 2026-106189, created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

sequence by host.name with maxspan=30s
  [ network where network.protocol == "http" and
      user_agent.original : "CriOS/*" and
      user_agent.original : "iPhone" ]
  [ network where network.protocol == "http" and
      url.path : "*reader*" and
      http.response.body : "*iframe*" ]

Splunk SPL Query

index=proxy OR index=web
| eval ua=coalesce(useragent, http_user_agent, c_useragent)
| where like(ua, "%CriOS/%") AND like(ua, "%iPhone%")
| search uri="*reader*" OR cs_uri="*reader*"
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as uris by src_ip, ua
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="web,cve-2026-106189,">
  <rule id="106189" level="5">
    <decoded_as>json</decoded_as>
    <field name="user_agent">CriOS/</field>
    <field name="user_agent">iPhone</field>
    <description>CVE-2026-106189: Chrome on iOS ReaderMode potential origin policy bypass activity</description>
    <group>attack.t1189,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

• Update Chrome for iOS to version 155.0.8059.39 or later, which the NVD description identifies as the fixed version. Because no patch advisory was supplied in the data, verify the installed version directly in the app and through managed-device inventory before relying on it.
• Where immediate update is not possible, reduce exposure: restrict or disable Reader Mode usage in managed browser policies if your MDM supports it, and restrict the Chrome for iOS version through mobile application management.
• Reinforce user-level controls against the social-engineering delivery vector: enable phishing-resistant MFA on accounts reachable from the browser, apply safe-browsing and URL filtering, and maintain user awareness for unexpected links delivered via messaging and email.

2. Patch / upgrade steps:

• Confirm current version on affected devices; if below 155.0.8059.39, install the update from the App Store or push it via MDM.
• Track Google's Chrome release channels for the corresponding iOS release notes and any security advisory that references this issue. No CVE-specific advisory URL, commit, or vendor fix reference was included in the supplied data; obtain the authoritative reference from Google before closing the finding.
• Re-verify version compliance across the mobile fleet after rollout.

3. Long-term hardening:

• Maintain automated mobile OS and browser version compliance monitoring so that client-side vulnerabilities in apps like Chrome for iOS are detected and remediated on a defined SLA.
• Adopt a policy of prompt patching for browsers and WebViews on mobile endpoints, which are frequent targets given their direct exposure to attacker-controlled web content.
• Continue defense-in-depth against origin-policy bypass classes via network egress filtering, DNS-layer protection, and phishing-resistant authentication so that a single browser flaw does not translate directly into account compromise.

References

• NVD — CVE-2026-106189: https://nvd.nist.gov/vuln/detail/CVE-2026-106189
• CWE-94 — Improper Control of Generation of Code ('Code Injection'): https://cwe.mitre.org/data/definitions/94.html
• Google Chrome release notes / Chrome for iOS updates (authoritative version information; no CVE-specific advisory reference was provided in the source data): https://chromereleases.googleblog.com/
• MITRE ATT&CK T1189 — Drive-by Compromise: https://attack.mitre.org/techniques/T1189/
• CISA KEV Catalog (this CVE is NOT listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaigns or exploit-in-the-wild evidence were provided in the source data. No public PoC, exploit code, or Nuclei template exists for this CVE. Note that exploitation of CWE-94 code injection is frequently weaponized in phishing campaigns, so supply-chain and user-targeted delivery should be monitored even absent confirmed in-the-wild activity.