CVE-2026-106387

Executive Summary

CVE-2026-106387 is a missing authorization vulnerability (CWE-862) in Google Chrome for iOS prior to version 155.0.8059.39. A remote attacker can leverage social engineering to obtain sensitive information via a crafted HTML page. With a CVSS base score of 8.8 and high confidentiality, integrity, and availability impact ratings, this vulnerability poses a significant risk to enterprise users relying on Chrome for iOS for business workflows.

Technical Analysis

The vulnerability is classified under CWE-862: Missing Authorization. This flaw occurs when a system, application, or component fails to enforce proper authorization checks, allowing an actor to perform actions or access resources that should be restricted. In the context of Google Chrome on iOS, the vulnerability lies within the Mobile component.

The NVD description states: "Missing authorization in Mobile in Google Chrome on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page." The attack requires user interaction (UI:R), meaning the victim must be convinced to visit a malicious or compromised webpage. Once the crafted HTML page is loaded, the missing authorization logic permits unauthorized access to sensitive information that would otherwise be protected.

The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates:

• Attack Vector: Network (AV:N) — the attack is deliverable remotely over the internet.
• Attack Complexity: Low (AC:L) — no specialized conditions are required for exploitation.
• Privileges Required: None (PR:N) — the attacker needs no prior authentication or authorization.
• User Interaction: Required (UI:R) — the victim must interact with the crafted HTML page.
• Scope: Unchanged (S:U) — the impact is confined to the vulnerable component.
• Confidentiality: High (C:H) — significant sensitive information exposure.
• Integrity: High (I:H) — data integrity is compromised.
• Availability: High (A:H) — availability of the affected component is impacted.

The Chromium security severity is rated Medium, but the NVD CVSS score of 8.8 places it in the High severity range. The discrepancy may stem from different scoring methodologies or the specific context of iOS deployments.

No public proof-of-concept, exploit code, or Nuclei template is available. Patch confidence is 0/4, indicating no tracked patch evidence from any source. The affected versions are not explicitly listed beyond the fixed version threshold.

Exploitation Scenarios

The following attack chain is inferred from the vulnerability class (missing authorization) and the NVD description. No specific function names, API endpoints, or code-level details are available from the provided data.

1. Reconnaissance/Target Identification: The attacker identifies individuals or organizations using Google Chrome on iOS versions prior to 155.0.8059.39. This may involve passive reconnaissance of public-facing web properties or targeted social media profiling.

2. Triggering the Flaw: The attacker crafts an HTML page designed to exploit missing authorization checks within the Mobile component of Chrome for iOS. The victim is lured to this page via social engineering — for example, a phishing link, malicious advertisement, or compromised legitimate website. Upon loading the page, the browser fails to enforce proper authorization controls, allowing access to sensitive information.

3. Payload/Execution: The crafted HTML page serves as the delivery mechanism. Depending on the exact nature of the missing authorization, the page may trigger requests that bypass access controls, exfiltrating data to an attacker-controlled server. The attack does not require the victim to install software or grant permissions beyond visiting the page.

4. Post-Exploitation Impact: Successful exploitation results in unauthorized access to sensitive information, potentially including user credentials, browsing data, or other confidential content stored or accessible via Chrome on iOS. The high integrity and availability impact ratings suggest the attacker may also modify or disrupt data access.

No public PoC is available; the attack chain is inferred from the vulnerability class and the limited description provided.

Impact Assessment

The CVSS base score of 8.8 reflects a high-severity vulnerability with significant consequences. The attack vector is network-based, requiring no privileges and low complexity, though user interaction is necessary. The confidentiality, integrity, and availability impacts are all rated High, indicating that a successful exploit could lead to substantial data exposure, data manipulation, and service disruption.

Affected systems are iOS devices running Google Chrome versions prior to 155.0.8059.39. The blast radius includes enterprise users who rely on Chrome for iOS for accessing corporate resources, web applications, and sensitive data. Given the social engineering requirement, targeted attacks against high-value individuals (executives, IT administrators, remote workers) are plausible. The lack of a public exploit or KEV listing suggests current exploitation is not widespread, but the vulnerability remains a credible threat for motivated attackers.

Business impact may include data breaches, regulatory compliance violations (e.g., GDPR, HIPAA), loss of intellectual property, and reputational damage. The high availability impact could disrupt business operations if critical web-based tools become inaccessible or compromised.

Detection Guidance

Sigma Rule

title: Potential CVE-2026-106387 Exploitation - Chrome iOS Missing Authorization
id: 8f9a2b1c-4d3e-5f6a-7b8c-9d0e1f2a3b4c
status: experimental
description: Detects crafted HTML page access attempts targeting Chrome on iOS with missing authorization indicators.
author: Threat Intelligence
date: 2026-06-15
logsource:
  category: web
  product: proxy
detection:
  selection:
    csUserAgent|contains: 'CriOS'
    csUri|contains: '.html'
    csMethod: 'GET'
  condition: selection
falsepositives:
  - Legitimate HTML pages accessed by Chrome iOS users.
level: medium
tags:
  - attack.t1190
  - cve.2026.106387

YARA Rule

rule CVE_2026_106387_Chrome_iOS_Missing_Auth
{
    meta:
        description = "Detects crafted HTML pages targeting missing authorization in Chrome iOS prior to 155.0.8059.39"
        author = "Threat Intelligence"
        date = "2026-06-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-106387"
        severity = "high"
    strings:
        $html_tag = "<html" nocase
        $script_tag = "<script" nocase
        $ios_crios = "CriOS" nocase
        $sensitive_keywords = "password" nocase
        $sensitive_keywords2 = "token" nocase
        $sensitive_keywords3 = "authorization" nocase
    condition:
        $html_tag and $script_tag and 1 of ($sensitive_keywords*) and #ios_crios > 0
}

Suricata IDS Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-106387 Chrome iOS Missing Authorization Exploit Attempt"; flow:to_server,established; content:"GET"; http_method; content:".html"; http_uri; content:"CriOS"; http_user_agent; sid:2026106387; rev:1; metadata:created_at 2026_06_15, cve CVE-2026-106387, confidence Medium;)

Elastic Detection

sequence by user_agent
  [network where user_agent : "CriOS*" and url.path : "*.html"]
  [network where user_agent : "CriOS*" and destination.port : (80 or 443) and network.bytes > 5000]

Splunk SPL Query

index=web sourcetype=access_combined
| search useragent="*CriOS*" uri_path="*.html"
| stats count by src_ip, uri_path, useragent
| where count > 5
| eval risk="CVE-2026-106387 potential exploitation"
| table src_ip, uri_path, useragent, count, risk

Wazuh OSSEC Rule

<group name="web,appsec,cve-2026-106387">
  <rule id="100387" level="10">
    <if_sid>31100</if_sid>
    <match>CriOS</match>
    <match>\.html</match>
    <description>CVE-2026-106387: Possible Chrome iOS missing authorization exploitation attempt</description>
    <group>cve_2026_106387,attack.t1190,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description references version 155.0.8059.39 as the fixed version, but no vendor advisory, OSV entry, or patch source is tracked.

1. Immediate Mitigations:

   • Disable or restrict the use of Google Chrome on iOS for accessing sensitive enterprise resources until a patch is confirmed.
   • Enforce network-level filtering to block known malicious HTML pages and domains associated with phishing campaigns.
   • Conduct user awareness training on social engineering tactics, emphasizing the risks of clicking unsolicited links on mobile devices.
   • Implement mobile device management (MDM) policies to enforce version control and restrict browser usage to approved applications.

2. Patch/Upgrade Steps:

   • Monitor Google Chrome release channels for iOS for version 155.0.8059.39 or later. Apply the update as soon as it becomes available.
   • Verify the update through official Google Chrome release notes or the Chrome Releases blog.
   • If no patch is released, consider switching to an alternative browser for iOS until remediation is available.

3. Long-Term Hardening:

   • Adopt a zero-trust architecture for mobile web access, requiring continuous authentication and authorization for sensitive resources.
   • Implement application-layer authorization checks independent of the browser to reduce reliance on client-side controls.
   • Regularly audit mobile browser configurations and enforce automatic updates via MDM.
   • Integrate threat intelligence feeds to proactively identify and block exploitation attempts targeting CVE-2026-106387.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-106387
• Google Chrome Release Notes (monitor for 155.0.8059.39): https://chromereleases.googleblog.com/
• CWE-862: Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
• Chromium Security Severity Guidelines: https://www.chromium.org/developers/severity-guidelines/
• CISA KEV Catalog (not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog