CVE-2026-14075: Chrome for iOS Policy Bypass Vulnerability

CVE-2026-14075 Overview

CVE-2026-14075 is an insufficient policy enforcement vulnerability in Google Chrome for iOS versions prior to 150.0.7871.47. A remote attacker can bypass the no-referrer policy by serving a crafted HTML page to a user. When the bypass succeeds, the browser leaks referrer information that the page author explicitly intended to suppress. Chromium rates the underlying security severity as Low, and the flaw maps to CWE-602: Client-Side Enforcement of Server-Side Security. Exploitation requires user interaction, such as visiting an attacker-controlled site, and does not grant code execution or account takeover.

Critical Impact
Attackers can force Chrome for iOS to disclose referrer data across navigations that should have carried no referrer, exposing internal URLs, session tokens embedded in paths, and browsing context to third-party origins.

Affected Products

Google Chrome for iOS versions prior to 150.0.7871.47
iOS devices running vulnerable Chrome builds
Web applications relying on the no-referrer policy for privacy or security

Discovery Timeline

2026-06-30 - CVE-2026-14075 published to the National Vulnerability Database
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-14075

Vulnerability Analysis

The vulnerability stems from incomplete enforcement of the Referrer Policy in Chrome for iOS. The no-referrer value instructs the browser to strip the Referer HTTP header and the document.referrer DOM property for all outbound navigations and subresource requests. Chrome for iOS failed to apply this policy consistently across every navigation path, allowing a crafted page to trigger a request that carried the original referrer.

The classification as [CWE-602] reflects a design pattern where the browser enforces a policy the server or page author declared. When that enforcement is incomplete, downstream origins receive information the page attempted to withhold. The bypass does not corrupt memory or execute arbitrary code, but it defeats a privacy control that sites use to protect URL-embedded secrets and internal navigation graphs.

Root Cause

The root cause is a policy enforcement gap in Chrome for iOS navigation handling. Specific navigation flows did not consult the active Referrer Policy before attaching the Referer header, so the no-referrer directive was silently ignored on those paths. Full technical details are tracked in the Chromium Issue Tracker Entry.

Attack Vector

An attacker hosts a crafted HTML page and lures a Chrome for iOS user to visit it. The page issues navigations or requests that should honor the no-referrer policy. Because Chrome does not enforce the policy on those code paths, the outbound request carries the referrer, exposing the source URL to the attacker or a third-party endpoint the attacker controls. No authentication or privileges are required, but the user must load the crafted page.

No verified public exploit or proof-of-concept code is available for this issue. See the Google Chrome Stable Update release notes for the vendor description.

Detection Methods for CVE-2026-14075

Indicators of Compromise

Outbound HTTP requests from Chrome for iOS User-Agent strings containing a Referer header where the source page declared Referrer-Policy: no-referrer
Web server access logs showing referrer values from internal or sensitive URLs on pages configured to suppress referrers
Chrome for iOS clients reporting a version string below 150.0.7871.47

Detection Strategies

Compare Referrer-Policy response headers against captured Referer request headers in web proxy or WAF telemetry to flag mismatches from iOS Chrome clients
Inventory managed iOS fleets for Chrome build numbers and identify devices below the fixed version
Correlate user agent strings with referrer leakage patterns in centralized log aggregation

Monitoring Recommendations

Ingest web server, CDN, and reverse proxy logs into a centralized analytics platform and alert on referrer leakage from no-referrer origins
Track Chrome for iOS version distribution in mobile device management (MDM) reporting
Review DNS and proxy telemetry for user traffic to newly registered domains serving crafted HTML that triggers policy bypass conditions

How to Mitigate CVE-2026-14075

Immediate Actions Required

Update Google Chrome for iOS to version 150.0.7871.47 or later through the Apple App Store
Push the updated Chrome build to managed iOS devices using MDM policies
Audit web applications for reliance on no-referrer to protect sensitive data in URLs and rotate any credentials that may have leaked

Patch Information

Google released the fix in Chrome for iOS 150.0.7871.47. Details are published in the Google Chrome Stable Update announcement, with the underlying bug tracked in the Chromium Issue Tracker Entry.

Workarounds

Move sensitive tokens out of URL paths and query strings so referrer leakage cannot expose them
Apply server-side controls such as short-lived tokens and origin validation instead of relying solely on client-enforced Referrer Policy
Restrict Chrome for iOS usage on managed devices until the patched version is deployed

bash

# Verify Chrome for iOS version via MDM query and enforce minimum build
# Example Jamf Pro smart group criteria
Application Bundle ID: com.google.chrome.ios
Application Version: less than 150.0.7871.47
# Action: assign remediation policy to force App Store update