CVE-2026-11302: Google Chrome Auth Bypass Vulnerability

CVE-2026-11302 Overview

CVE-2026-11302 is an insufficient policy enforcement vulnerability in Google Chrome for iOS prior to version 149.0.7827.53. The flaw allows a remote attacker to bypass discretionary access control through a crafted HTML page. The issue is tracked under [CWE-284] (Improper Access Control) and requires user interaction to trigger. Google rated the Chromium security severity as Low, while NVD assigned a CVSS 3.1 base score of 4.3.

Critical Impact
A remote attacker can bypass discretionary access controls in Chrome for iOS by delivering a crafted HTML page, leading to limited integrity impact on the browser security model.

Affected Products

Google Chrome for iOS versions prior to 149.0.7827.53
Apple iPhone OS (iOS) devices running vulnerable Chrome builds
Any iOS deployment relying on Chrome browser policy enforcement

Discovery Timeline

2026-06-05 - CVE-2026-11302 published to NVD
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-11302

Vulnerability Analysis

The vulnerability resides in Chrome for iOS and stems from insufficient enforcement of browser security policies. Chrome's discretionary access control (DAC) mechanisms govern what cross-origin or cross-context operations a web page can perform. When these controls are not consistently enforced, an attacker-controlled HTML page can perform actions that should otherwise be blocked by Chrome's policy boundaries.

The flaw is classified under [CWE-284] (Improper Access Control). Exploitation requires user interaction, typically by convincing the victim to visit a crafted web page in Chrome for iOS. The impact is limited to integrity, with no direct confidentiality or availability impact reported. The EPSS data indicates a low likelihood of exploitation in the near term.

Root Cause

The root cause is improper enforcement of policy checks within the iOS-specific implementation of Chrome. Because Chrome on iOS is built on Apple's WebKit (per App Store policy) rather than Blink, platform-specific code paths handle policy decisions differently from desktop Chrome. A logic gap in these checks lets a crafted page reach functionality it should not access.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker hosts a malicious HTML page and lures a victim into visiting it with Chrome for iOS prior to 149.0.7827.53. Upon rendering, the crafted content exercises the policy-enforcement gap and bypasses discretionary access control. No authentication is required, and no special privileges are needed on the victim device.

No public proof-of-concept code, exploit, or vendor technical write-up is currently available. Refer to the Chromium Issue Tracker Entry and the Google Chrome Stable Update for further details as they are disclosed.

Detection Methods for CVE-2026-11302

Indicators of Compromise

Chrome for iOS clients reporting User-Agent versions below 149.0.7827.53 in web proxy or access logs
Outbound HTTPS sessions from iOS devices to newly registered or low-reputation domains delivering HTML payloads
Anomalous cross-origin requests originating from Chrome iOS sessions immediately after visiting untrusted pages

Detection Strategies

Inventory mobile endpoints and enumerate installed Chrome for iOS versions through MDM telemetry
Inspect web gateway logs for iOS Chrome User-Agent strings that have not been updated to 149.0.7827.53 or later
Correlate URL category telemetry with mobile browsing sessions to flag visits to high-risk HTML content

Monitoring Recommendations

Track Chrome stable channel advisories and align mobile patch cycles to ship updates within defined SLAs
Monitor MDM compliance dashboards for outdated Chrome iOS installations and trigger remediation workflows
Alert on repeated failed policy checks or unusual cross-origin behavior in mobile browser telemetry where available

How to Mitigate CVE-2026-11302

Immediate Actions Required

Update Google Chrome for iOS to version 149.0.7827.53 or later on all managed iOS devices
Push the update through Apple Business Manager or MDM to enforce timely remediation across the fleet
Communicate the advisory to users with unmanaged devices and require self-service updates via the App Store

Patch Information

Google addressed the vulnerability in Chrome for iOS 149.0.7827.53. Details are listed in the Google Chrome Stable Update release notes and tracked in the Chromium Issue Tracker Entry. No vendor workaround is published; upgrading to the fixed version is the supported remediation path.

Workarounds

Restrict use of Chrome for iOS on managed devices until the patched version is deployed, falling back to a fully updated alternative browser
Apply web filtering policies to block access to untrusted or uncategorized HTML content from mobile devices
Enforce MDM configuration profiles that require minimum approved versions of Chrome before granting network access

bash

# Example MDM compliance check for Chrome for iOS version
# Pseudocode for an MDM policy rule
required_app: com.google.chrome.ios
minimum_version: 149.0.7827.53
non_compliance_action: block_corporate_network_access