CVE-2026-113196: Google Chrome iOS Auth Bypass Vulnerability

CVE-2026-113196 Overview

CVE-2026-113196 is an improper access control vulnerability in Google Chrome on iOS prior to version 156.0.8078.47. The flaw resides in the Mobile component and allows a remote attacker to bypass the web origin policy using a crafted HTML page. Chromium security rated the issue Medium severity, and it is tracked under CWE-284 (Improper Access Control). The vulnerability requires user interaction, as a victim must load the attacker-controlled HTML content in the browser. Exploitation undermines the same-origin boundary that isolates content from different web origins, enabling cross-origin data access or interaction that would otherwise be blocked.

Critical Impact
A remote attacker can bypass the web origin policy in Chrome on iOS through a crafted HTML page, breaking cross-origin isolation guarantees.

Affected Products

Google Chrome on iOS prior to 156.0.8078.47
Mobile component of Chromium on iOS
Downstream iOS browsers embedding the affected Chrome build

Discovery Timeline

2026-10-20 - CVE-2026-113196 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-113196

Vulnerability Analysis

The vulnerability stems from improper access control in the Mobile code path of Google Chrome on iOS. The web origin policy, commonly known as the same-origin policy, restricts how a document loaded from one origin can interact with resources from another origin. On iOS, Chrome operates under constraints imposed by WebKit while layering its own navigation, UI, and origin-enforcement logic. The flaw allows a crafted HTML page to circumvent these origin checks. An attacker who convinces a user to visit a malicious page can perform actions or read data across origin boundaries that should be isolated. The result is a breach of the browser security model that web applications rely on for confidentiality and integrity.

Root Cause

The root cause is categorized under CWE-284, Improper Access Control. The affected code path fails to enforce origin boundaries correctly when handling specific HTML content constructs. Chromium's public issue tracker entry #504231046 contains additional technical context once access restrictions are lifted.

Attack Vector

Exploitation is remote and requires user interaction. An attacker hosts a crafted HTML page and lures a victim to open it in a vulnerable Chrome build on iOS. Once rendered, the page triggers the access control weakness and interacts with content from a different origin. Delivery channels include phishing links, malvertising, compromised sites, and embedded iframes. No authentication is required on the target device.

No verified public exploit code is available. For technical remediation details, review the Google Chrome Stable Update advisory.

Detection Methods for CVE-2026-113196

Indicators of Compromise

Chrome on iOS clients running versions below 156.0.8078.47 connecting to untrusted web content
Browser telemetry showing cross-origin requests or script execution against sensitive origins following navigation to unfamiliar domains
User reports of unexpected authentication prompts, session anomalies, or data appearing in unrelated web applications

Detection Strategies

Inventory mobile browser versions through mobile device management (MDM) and flag Chrome iOS installs below 156.0.8078.47
Inspect web proxy and DNS logs for traffic to newly registered or low-reputation domains delivering HTML payloads to iOS Chrome user agents
Correlate web application logs for anomalous cross-origin API calls originating from mobile Chrome sessions

Monitoring Recommendations

Enable mobile browser telemetry forwarding to a central analytics or SIEM pipeline for version and navigation visibility
Monitor identity provider logs for session reuse or token access patterns inconsistent with the origin that issued the session
Track MDM compliance dashboards for Chrome iOS updates and alert on devices lagging behind the fixed build

How to Mitigate CVE-2026-113196

Immediate Actions Required

Update Google Chrome on iOS to version 156.0.8078.47 or later through the Apple App Store
Push the updated Chrome build to managed iOS fleets using MDM app update policies
Advise users to avoid opening untrusted links in Chrome on iOS until the update is applied

Patch Information

Google addressed CVE-2026-113196 in Chrome 156.0.8078.47 on iOS. Refer to the Google Chrome Stable Update release notes and the Chromium Issue Tracker #504231046 entry for the authoritative fix references.

Workarounds

Use an alternate up-to-date browser on iOS until the Chrome update is installed on all devices
Restrict access to sensitive internal web applications from mobile Chrome sessions through conditional access policies
Enforce web filtering on mobile devices to block known malicious and newly registered domains that could host crafted HTML payloads